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MACROMEDIA: JAVA, 
COLDFUSION USERS SAFE 



Adobe takeover won't 

BY DAVID RUBINSTEIN 

Calling ColdFusion and J2EE 
"the core DNA of our compa- 
ny," Macromedia chief software 
architect Kevin Lynch last 
month indicated the upcoming 
takeover by Adobe Systems Inc. 
for approximately US$3.4 bil- 
lion will not change anything for 
developers using those tools. 

Noting that he could not dis- 
cuss much due to the quiet peri- 
od mandated by federal rules 
governing corporate acquisi- 
tions, Lynch said Macromedia's 
recently released update to 
ColdFusion "was the best in at 
least five years, and that com- 
munity is quite strong." He fur- 
ther hinted that he expects the 



impact company's core 

new combined company to con- 
tinue developing and maintain- 
ing ColdFusion and the Java 
application server. 

Lynch said discussions 
between the companies have 
been going on for quite some 
time, and that both companies 
knew a takeover was a possibility. 
The companies — Adobe sells 
Photoshop and Acrobat; Macro- 
media has Flash and application 
design and development tools — 
see a synergy in the creation and 
delivery of sophisticated, power- 
ful applications across multiple 
operating systems. Acrobat and 
Flash are on millions of desktops 
around the world for the delivery 
► continued on page 24 



CA Relegates 
Developer Tools 
To Back Seat 

Company looks to drive growth with 
network management, security offerings 



BY DAVID RUBINSTEIN 

The acquisition last month by 
Computer Associates of network 
management software provider 
Concord Communications was 
completed to plug an admitted 
hole in CAs Unicenter enter- 
prise systems management solu- 
tion. That, coupled with the 
company's realignment of its 
business units in April, sent a 
clear signal that its myriad devel- 
opment tools on their own are 
not central to the business. CA 
paid US$330 million for Con- 
cord, a transaction described by 
CAs executive vice president for 
products, Russell Artzt, as 
"strengthening an area that real- 
ly needed strengthening." The 
cash deal is expected to close by 
early July. 

Concords revenue for fiscal 
2004 was $106.2 million, but 
stockholders apparently liked 
the announcement, driving up 
CAs price in the immediate 
aftermath of the announcement. 



"It's a strategic acquisition in our 
core area, and we'll look to grow 
it rapidly," he said. "It's right in 
the heart of where we play." 

Artzt said that when CA loses 
deals, the reason most often cit- 
ed is the company's weakness in 
network management. With the 
earlier acquisition of security 
► continued on page 26 




Some products 'are not as directly 
in the core' of CA's business, 
acknowledged Artzt. 



Expanding Array of App Security Offerings 

NT Objectives enters fray; three announce updates 



BY JENNIFER DEJONG 

A new entrant joined the grow- 
ing number of companies that 
sell tools to help teams write 
software that is more secure, and 
three established players updat- 
ed their offerings last month. 

NT Objectives opened its 
doors for business in Irvine, 
Calif., announcing a simulation 
testing tool, NTOSpider, as well 
as service offerings to help 
teams better integrate applica- 
tion security into the software 
development life cycle. 

At the Software Security 

Summit in San Diego, which 

► continued on page 26 




LogicLibrary's Logicscan provides a three-dimensional view of the app, 
highlighting exploitable vulnerabilities in red. 
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BORLAND: NO 
DEVELOPER 
LEFT BEHIND 

BY JENNIFER DEJONG 

Core SDP may be Borland's 
new favorite application life- 
cycle management suite, but 
Borland insists it has not aban- 
doned two of its oldest off- 
spring, both of which date back 
to the company's earliest days. 

"[Core SDP] won't leave 
Delphi and C++ developers be- 
hind," said Borland's Michael 
Swindell, director of product 
management for Delphi. Code 
written in either language will 
be fed into the Core SDP infor- 
mation chain, he said, referring 
to the software development 
platform launched earlier this 
year that includes the role- 
based offerings Core Analyst, 
Core Architect, Core Develop- 
er and Core Tester. 

Delphi and C++ developers 
► continued on page 25 
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NASA to Blast Off With GuiGuru 

Stottler Henke claims Java, C++ tool builds interfaces that fly right 



BY EDWARD J. CORREIA 

Imagine being handed a dozen 
scientific experiments developed 
by a dozen different engineers, 
each with its own user interface. 
Now try to conduct those exper- 
iments in an extremely con- 
strained space, with very little 
time and limited life-sustaining 
resources. That approaches the 
problems faced by astronauts 
orbiting the Earth in the Inter- 
national Space Station as they 
attempt to perform their duties. 
"The problem NASA has is 
they have all kinds of random 
people developing these experi- 
ments, and usually the interface 
is not their central [concern]," 
said Annaka Kalton, project 
manager for the GuiGuru pro- 
ject, a product under construc- 
tion at development tools com- 
pany Stottler Henke Associates. 
She said GuiGuru is intended to 
help NASA correct the problem 
of interface inconsistency by 
encoding the space agency's 
interface requirements — all 100 
pages of them — and coaching 
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In the elicitation module, developers enter test requirements in flowchart form. 



interface designers as they go 
along. "[NASA] has a huge list 
of commonality standards, such 
as font and color usage. For 
example, you can't use bright 
red or bright green, because 
those have different meanings 
on the space station." The soft- 
ware is now in beta. 



Once specs are entered, 
Kalton said GuiGuru guides an 
interface developer through the 
process of creating a task-ori- 
ented interface, rather than the 
sort of random access interface 
that engineers are inclined to 
create. "There are an awful lot 
of crummy interfaces out there; 



they're hard to use or not 
oriented toward the tasks 
you need to do." The 
software outputs C++ or 
Java code with stubs for 
linking back-end business 
logic, she said. 

Kalton said the compa- 
ny plans to release the first 
three modules sometime 
this month: the knowledge 
elicitation module to gar- 
ner task information; an 
instructions module that 
actually builds the inter- 
face; and an evaluation 
step, which reports poten- 
tial interface problems. 
The final version, due later 
this year, will include 
interface output and 
usability testing modules. "At 
that time we'll be looking for 
potential commercial clients 
whose needs we can fold in." 
Pricing was not disclosed. 

The general release version 
will permit enterprises to input 
their own interface specifica- 
tions. "We're using a graphical 



programming tool that we 
developed to write the criteria," 
Kalton said. "But clients would, 
in theory, be able to write their 
own specific parameters such as 
simple color usage, or more 
complicated things such as 
addressing and layout." 

The development environ- 
ment has been tested only on 
Windows hosts, but according 
to Kalton is not limited to that 
platform. "Because it's written 
in Java, it's at least theoretically 
platform-independent. We just 
have to do a little testing for 
additional platforms to make 
sure all our functionality trans- 
fers gracefully." 

Kalton claimed the interface 
environment, which uses main- 
ly Swing components, is 
dynamic and flexible. "We read 
in whatever widgets the client 
feels like providing support 
for." She added that while Stot- 
tler uses Eclipse for in-house 
development, it has no plans to 
release GuiGuru under the 
framework. I 
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Microsoft's Cathedral, Java's Bazaar 

C# developers chained to Whidbey while nimble Java advances 



BY EDWARD J. CORREIA 

One might say that a scene from 
"The Cathedral and the Bazaar," 
Eric Raymonds visionary look in 
2000 at the open-source com- 
munity is being played out in a 
present-day drama starring 
Microsoft's C# and Sun's Java. 

While the forthcoming C# 
2.0 promises generics, iterators, 
anonymous methods and other 
significant advances, most 
developers will not begin using 
them until the release of Visual 
Studio 2005, which SD Times 
has learned might be delayed 
until early 2006. Innovations 
emerge slowly from the Micro- 
soft Cathedral. 

Meanwhile, developers using 
the community-advanced Java 
language have been enjoying 
generics since last September's 
release of Java 5, and are likely 
to gain a whole lot more when 
Java 6, code-named Mustang, is 
unleashed in 2006. The spec 
has only recently reached the 
JSR stage, and what will make it 
in remains unclear. 

Ironically, the new features 
in C# are ready to use right now 
but require a beta compiler, said 
Larry O'Brien, Windows & .Net 
Watch columnist for SD Times. 
"There's no question that the C# 
language design team had been 
thinking about features such as 
generics since 2001 that are still 
forthcoming, and the beta com- 
piler is actually quite stable. But 
because Microsoft has this 
grand release cycle, a lot of 
these language features aren't in 
the hands of developers." 

Still, Microsoft's new lan- 
guage has made progress. "A 
big milestone for C# 2.0 is that 
it's just been submitted for final 
approval to EC MA, which puts 
it on a fast track for ISO stan- 
dardization. The language is 
nailed down in terms of fea- 
tures," O'Brien said. 

What's interesting, O'Brien 
added, is that when the original 
specifications for C# came out in 
2001, "everyone said that C# was 
leapfrogging [Java]. But what's 
ironic is that Java 5 is now out 
while C# 2.0 is being delayed." 

"Java is benefiting in this 
case from not being coupled 
into an entire development 
environment," pointed out 
Allen Holub, architect, consul- 
tant and instructor in C/C+ + , 
Java and OO design and Java 
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SD Times columnists Larry O'Brien, left, and Allen Holub discuss the relative merits of Java 5 and C# 2.0. 



Watch columnist for SD Times. 
"It is just a language, and peo- 
ple working on it can focus on 
the language, and let everything 
else take care of itself." 

C# PLUS PLUS 

Among C# 2.0's new features is 
the iterator block, which 
O'Brien described as a means 
to build functions that yield 
successive values. "For in- 
stance, if you wanted to create a 
series of prime numbers, the 
function when it's called again 
restores the state to [the next] 
point," saving the developer 
from writing the many lines of 
code otherwise required to spit 
out numbers in succession. 

C# also will support partial 
classes, which O'Brien said 
allows a class to be defined in 
more than one file or compila- 



tion unit. "The big advantage is 
that it helps with code genera- 
tion," he said, because one tool 
might be used to generate all the 
boilerplate code while the pro- 
grammer deals with a separate 
file. "This way you don't have to 
deal with special markers in the 
files that say, 'Don't touch this' 
and 'Do touch that.' But this is 
my least favorite new feature." 

Among the most talked-about 
new language features is gener- 
ics, which Holub said lets devel- 
opers write code before knowing 
the program's variable types. "It's 
[otherwise] very difficult to do 
some kinds of generic program- 
ming in the sense of a data struc- 
ture. Because if you don't know 
the types, that makes the code 
nasty, more error-prone and 
harder to deal with. Generics 
allow you to give the compiler 



what it needs to effectively cus- 
tomize the way a class is used for 
a particular typing system." 

Talking about data structures, 
O'Brien explained, is like talking 
about lists. "For instance, a list of 
cats versus a list of dogs. With 
generics, you're able to make 
sure that a list of cats, once 
you've created it, will prevent 
you from putting a dog in." And 
that simplifies programming, 
added Holub, "because when 
you pull something out of [the 
list], you know as a fact that it's a 
cat, and you don't have to worry 
about putting in any manual tests 
you would otherwise need." 

SWEET J N' SLOW 

Interestingly, C# 2.0 and Java 5 
implement generics in different 
ways. "Behind the scenes in 
Java, a list of cats and a list of 



dogs is the same thing," said 
O'Brien. "But in .NET, [differ- 
ent] value types will be different 
objects in memory. The generic 
type is instantiated at runtime to 
be specific to the type of thing 
that's put into it." 

That's both good and bad, he 
said. Two advantages of .NET's 
generics implementation are 
higher performance and code 
safety. "You cannot cast away 
the .NET runtime type. That's a 
pretty esoteric thing, but it can 
be done with Java generics and 
not with .NET generics." 

The bad news about Micro- 
soft's approach is incompatibility 
with existing VMs. "Microsoft 
has decided that generics are so 
important that they are imple- 
mented at the VM level," 
O'Brien said. In Java, the imple- 
mentation was designed to be 
compatible with existing VMs. 
"In Java, generics are essentially 
compiler syntactical sugar." 

Holub called into question 
whether generics should be 
implemented in the first place. 
"The issue about generics that 
I think is important is that they 
make this distinction between 
value types and normal classes 
at all. That is a fundamental 
flaw in both languages because 
it's an optimization the compil- 
er could do but doesn't." He 
suggested that the reason 
generics exist has more to do 
with history than with lan- 
guage theory. "Programmers 
► continued on page 20 



Team System Might Miss Delivery Date 

But Microsoft delivers betas of Visual Studio, SQL Server 2005 



BY JENNIFER DEJONG 

It looks like Microsoft may do it 
again: miss another key delivery 
date. Several sources close to 
Microsoft said last month that 
the launch of the Team System 
edition of Visual Studio 2005 
has been delayed until the first 
quarter of 2006. 

Asked to comment, a 
Microsoft spokeswoman said 
Visual Studio 2005, including 
the Team System edition, is 
"expected in the second half of 
calendar 2005." 

The Microsoft spokeswoman 
would not confirm that delivery 
is being pushed back until 2006, 



and insisted that the "second 
half of calendar year 2005" 
announced on March 21 did not 
represent a slipped delivery date 
from an earlier promise of a 
summer delivery. "The term 
'summer' is confusing," she said. 
"It means different things in dif- 
ferent parts of the country." 

The delivery of Team Sys- 
tem is critical because it is 
Microsoft's first role-based edi- 
tion of its IDE, which it 
promised would include tools 
not just for developers, but also 
for architects, testers and IT 
operations managers. IBM 
delivered its own role-based 



offering, the IBM Software 
Development Platform, late 
last year. On April 18, Microsoft 
released beta 2 of Visual Studio 
2005 (lab.msdn.microsoft.com 
/vs2005) as well as a Communi- 
ty Technology Preview (CTP) 
of SQL Server 2005, also 
promised for the second half of 
this year. Eric Rudder, Micro- 
soft's senior vice president of 
servers and tools, said in a state- 
ment: "Delivering Visual Studio 
2005 Beta 2 and the SQL Serv- 
er 2005 April CTP to customers 
is a milestone because it indi- 
cates that we have entered the 
final stages of the development 



cycle for both products." 

Asked whether Microsoft 
expects to release a third beta 
for Visual Studio 2005, another 
spokeswoman said [on April 
18]: "The plan right now is to 
continue to release CTPs until 
RTM [release to manufacture]." 
Unlike beta releases, which 
typically include new features, 
CTPs are intended simply to 
expose the latest working build 
to developers. 

The same release strategy is 
planned for SQL Server 2005, 
the spokeswoman said. The 
company delivered beta 2 last 
July. I ' 
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Coming Together With Visual Studio 



Borland updates UML modeler for Microsoft IDE based on roles 

BY JENNIFER dejong development environment. an updated version of its model- 2005 is role-based, providing a 

It may be shifting its focus to The company was expected ing offering for Microsoft devel- tool for developers, as well as 

Core SDP, but Borland is still last month to announce Togeth- opers. Unlike its predecessor one for architects and analysts, 

getting together with Microsoft's er 2005 for Visual Studio .NET, released last May, Together said Marc Brown, Borland's 
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director of product marketing, 
noting that the company's life- 
cycle development platform 
Core SDP also provides role- 
specific tools. Also new to 
Together 2005 is support for 
Unified Modeling Language 
(UML) 2.0 and for Object Con- 
straint Language (OCL), which 
is used to further define specifi- 
cations in a model. 

Despite its "2005" designa- 
tion, the new modeler works 
with Visual Studio 2003, not 
the forthcoming 2005 edition, 
promised by Microsoft for the 
second half of this year. 

Together Designer, which 
costs US$1,500 per user, lets 
architects and analysts design 
an application and model its 
requirements without having 
to focus on one particular pro- 
gramming language, said Brown. 
It also lets them import files 
from IBM Rational modeling 
tools and provides better inte- 
gration with CaliberRM, Bor- 
land's requirements manage- 
ment tool. 

When the application model 
is complete, developers trans- 
form the design into a platform- 
specific model using Together 
Developer, which costs $1,000 
per user. New to Developer is 
Visual Basic .NET support for 
refactoring, audits and metrics. 
Refacto rings, such as rename, 
automate the process of 
restructuring code to improve 
performance, while audits 
inspect code for complexities 
that could cause maintenance 
issues, and generate metrics 
accordingly. Audits and C# 
refactoring were supported in 
the prior version, but C# audits 
are new to the 2005 offering, 
said Brown. 

ROOM FOR BOTH 

Other than its drawing tool, 
Visio, Microsoft does not offer 
modeling tools. But the Team 
System edition of Visual Studio 
2005 is expected to include 
Microsoft's first efforts, includ- 
ing a Web services designer 
and Class Designer, which is 
based on Microsoft's own mod- 
eling notation, not on UML 
2.0. Borland, which plans to 
update Together to support 
Team System, believes there is 
room for both approaches, said 
Brown. An organization might 
define its enterprise architec- 
ture using UML 2.0, while 
designing Web services and 
components with Microsoft's 
forthcoming tools. Borland will 
play a key role in bridging that 
gap, he said. I 
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NEW PRODUCTS 



NetEdge Software is offering Refactor Express, a service that con- 
verts Microsoft Access' user interfaces to .NET WinForms and Web- 
Forms. The service downloads a profiling component that scans the 
existing Access application and prepares a descriptive file for conver- 
sion; that file is uploaded to the NetEdge server, which processes it 
and returns C# or Visual Basic .NET code for the WinForms or Web- 
Forms applications . . . Inquire Tec Software 
has launched lnquire4D, a speech user 
*^J P . A interface add-in for 4D's 4th Dimension 
*vr. . database. The basic version of the software, 
called SUI Lite, works with Mac OS X and Windows, and costs US$89 
per developer. A more advanced version, called SUI Pack, costs $199 
per developer and allows for voice-enabled data entry . . . CollabNet 
has released CollabNet Team Edition, a hosted service version of its 
distributed development system. The software costs US$65 per user 
per month. 



UPGRADES 



The new version of JGL Toolkit, a Java generic programming facility 
from Recursion Software, has been designed to work with Java JDK 
5.0, with 28 additional collections, 205 additional algorithm methods, 
eight new comparators and 31 added iterators. JGL Toolkit 5.0 costs 
US$99.95 . . . Original Software is offering TestWeb 2.6, a script 
tester for browser-based applications running on IBM iSeries, Oracle 
and Windows platforms. The company describes the test software as 
self-healing, in that the tool analyzes the intentions of the script and 
executes by directly communicating with the Web page elements, even 
if the interface has changed slightly. Price depends on the number of 
concurrent users . . . C Point has enhanced its Antechinus JavaScript 
Editor, a Web application for creating active HMTL pages. Version 5.0 
of the script editor includes new syntax checking with error highlight- 
ing, one-click testing of code, a function finder and new code tem- 
plates. The US$49.95 tool also makes it easier to switch modes from 
visual HTML designing to script editing . . . Microsoft has released Ser- 
vice Pack 1 for Windows Server 2003. The security-focused update 
has a new security configuration wizard, Windows firewall similar to 
the one included with Windows XP Service Pack 2, and post-setup 
security updates. It also has a metabase auditor for Internet Informa- 
tion Services, designed to help administrators identify and recover 
from malicious usage, as well as the ability to guarantine out-of-date 
virtual private networking assets. 



PEOPLE 



nEn| : BZ Media, publisher of SD Times, 
■ 1 has hired Agnes Vanek as director 
■■" I of circulation; she had been senior 

I audience manager for 101 Communica- 
..cJ&^B tions' Federal Computer Week media 
*^^^^^^ group. She takes over circulation from 
VANEK PAPPAS Rebecca Pappas, who is now BZ 

Media's director of IT and manufacturing ... HP has replaced the 
fired Carly Fiorina with Mark Hurd. The new CEO and president 
had held those same titles with NCR since March 2003. The acting 
CEO, Robert Wayman, will remain as CFO, the role he had before Fio- 
rina left the company. Patricia Dunn will remain as nonexecutive 
chairman of the board of directors . . . John Andrews is the new 
COO of marketing researcher Evans Data. Andrews had been CIO at 
GTE and CSX, and had been CEO of Giga Information Group before 
its purchase by Forrester Research . . . LogicLibrary has hired Ralph 
Massaro as VP and general manager of content products. He had 
been EVP of sales for Solvaire Technologies, a document manage- 
ment start-up . . . Web services management company Cape Clear 
Software has hired Chris Rowett as director of technology 
for Europe. Rowell was previously in charge of EMEA professional 
services for Sonic Software . . . Maura McGinnity is the new VP of 
market strategy and corporate development at Visual Numerics; she 
had previously been senior director of marketing. I 



Systinet Promotes SOA 
Governance Framework 

Ten vendors back registry-based system 



BY YVONNE L. LEE 

Systinet, which makes a reg- 
istry based on the Universal 
Description, Discovery and 
Integration (UDDI) Web ser- 
vices specification, announced 
last month a framework 
through which the services of 
third-party companies could 
connect to the registry with the 
goal of making the services eas- 
ier to govern. 

The new framework, called 
the Governance Interoperabili- 
ty Framework (GIF), is de- 
signed for additional services 
such as security, management, 
data access and integration, that 
run with the actual Web ser- 
vices, said Dave Butler, vice 
president of marketing. 

"Governance is quite simply 
the enforcement of policies 
and making sure the applica- 
tions are going to work as spec- 
ified with good behavior," said 
Butler. "In the case of SOA, 
because you're creating busi- 
ness services that are indepen- 
dent of each other, the only 
way you can make sure they're 
going to interoperate correctly 
is what is called governance," 




Source: Systinet 



Systinet's GIF melds specifications and policies from governance for com- 
mon business services. 



he said. "Bad behavior would 
be they're not secure, or that 
they don't meet a certain ser- 
vice level agreement." 

The GIF will form a founda- 
tion for common reporting, 
alerts and data among the gov- 
erning services, Butler said. 

"When customers build out 
an SOA, they typically buy 
management, security, mes- 
saging and other components 
from multiple vendors," said 



Tech-Ed 2005 Next Month 



BY JENNIFER DEJONG 

Microsoft's Tech-Ed 2005 
conference is scheduled to take 
place June 5-10 in Orlando, 
Fla. 

Aimed at ISVs, develop- 
ment managers and IT profes- 
sionals, conference sessions are 
organized around 18 technical 
tracks, including architecture, 
developer tools, mobile solu- 
tions, security and Web devel- 
opment. 

Hands-on lab sessions will 
focus on forthcoming technolo- 
gies, expected in Visual Studio 
2005, now promised for year's 
end. Topics include the Team 
System modeling, testing and 
source control features, which 
Microsoft announced at last 
year's Tech-Ed conference, as 
well as smart client and mobile 
development. 

Microsoft and more than 
200 software vendors are ex- 
pected to exhibit products and 
services at the conference. I 
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www.microsoft.com/events 
/teched2005 



Ian Bruce, director of market- 
ing. "They need a place where 
all the information about these 
components and about the 
services they support is col- 
lected and made available." 
The GIF will become that 
place, he said. 

The GIF will include a set 
of APIs for unifying and stor- 
ing data from the Web services 
themselves and from these 
governing services. It also 
works with existing Web ser- 
vices standards to tie together 
alerts, change management 
and provisioning from differ- 
ent services, said Bruce. Final- 
ly, the GIF involves APIs for 
tying together information 
into a common "uber-console" 
to the degree that organiza- 
tions decide to capture man- 
agement information among 
Web services within a single 
console, he said. 

In addition to information 
such as WSDL location and 
other information traditionally 
stored in a UDDI registry, the 
framework would use the reg- 
istry to store other information 
required to make the services 
work together smoothly, said 
Butler. 

Ten vendors — Above All 
Software, Actional, Amberpoint, 
Composite Software, Data- 
power, Hewlett-Packard, Layer 
7 Technologies, MetaMatrix, 
Reactivity and Service Integri- 
ty — have agreed to jointly devel- 
op governance services that 
work with the framework by the 
end of 2005. 1 
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Gridders Tackle Distributed Apps With Open Source 

ActiveGrid takes XML approach to deliver scalability on inexpensive servers 



BY YVONNE L. lee deployed by Amazon, Google cals, business and consumer ser- that can be scaled on multiple 

ActiveGrid has released a plat- and Sabre. vices, and manufacturing indus- inexpensive servers, said CEO 

form designed to create grid- The company is targeting the tries. Specifically, the platform is and founder Peter Yared, who 

based applications, such as those financial services, pharmaceuti- designed to deliver applications was a former CTO at Sun. 
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"You go to a lot of next-gener- 
ation deployments, they're run- 
ning large clusters of small com- 
modity machines," he said. 
"When you talk to folks at 
Google, they don't care when 
their machines break." Organiza- 
tions running applications in such 
an architecture replace malfunc- 
tioning computers and the appli- 
cations continue to run, he said. 

ActiveGrid's platform con- 
sists of the ActiveGrid Applica- 
tion Builder and the Grid Appli- 
cation Server. The application 
builder runs on Linux, Mac OS 
X and Windows desktops. It uses 
graphical editors to create XML 
documents that describe the 
application flow The data mod- 
eling editor uses XML Schema, 
the application flow editor uses 
Business Process Execution 
Language, the form editor uses 
XForms, and queries are 
defined in XPath. 

Yared said this XML-based 
approach means developers can 
write programs without consid- 
ering the deployment pattern. 

"Instead of hard coding how 
an application flows, you 
describe the application flows, 
and then the cluster at runtime 
can fill in the glue of how to get 
from one stage to another. That 
glue can change based on your 
policy or context," he said. 

The Grid Application Server 
interprets these application 
descriptions at runtime, and can 
make decisions based on context, 
such as how to cache a set of data 
across the grid, or how to render 
a form fragment for a particular 
type of client and user role. In 
addition to directly creating 
applications, the platform can be 
used to stitch together applica- 
tions written in various lan- 
guages. The Grid Application 
Server runs on the LAMP stack, 
which consists of Linux, the 
Apache Web server, the MySQL 
database, and the PHP, Python 
and Perl scripting languages. 

The Grid Application Server 
is designed to scale linearly to up 
to 1,024-node grids. This limita- 
tion is not due to the software, 
but to the limits of how Gigabit 
Ethernet currently can be net- 
worked, Yared said. 

An early access version of the 
software is available now for free 
download at www.activegrid.com 
/downloads/index.php. Pricing 
was yet to be determined. I 
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Native .NET Rules Engine Gets a Boost 



BY JENNIFER DEJONG 

InRule has reinforced its native 
.NET rules offering. 

The 2-year-old Chicago- 
based company updated its 
business rules engine in late 
March, adding support for deci- 
sion tables and mobile devices, 
and boosting performance. 

InRule 2.6 is an infrastruc- 
tural release, said CEO Paul 
Hessinger. Decision tables, a 
feature common to most rules 
offerings, make it easier for 
business users and developers 
to create and update a group of 
related rules in a table format, 
instead of managing each rule 
individually, he said. Support 
for Web Services Enhance- 
ments for .NET (WSE) 2.0 lets 
an InRule application switch 
between executing remotely on 
a smart client and executing on 
the server. That's key for appli- 
cations, such as those used to 

IBM Extends 
Apps on z/OS 

BY DAVID RUBINSTEIN 

To improve its customers' abili- 
ty to create and deploy main- 
frame applications on z/OS, 
IBM in late March made a 
series of product enhancements 
to its WebSphere and Rational 
product lines. 

First, IBM released Web- 
Sphere Application Server 6.0 
for z/OS, according to Rachael 
Rusting, group marketing man- 
ager for Rational Team prod- 
ucts. "It has the same codebase 
as WebSphere Application Ser- 
ver," she said, adding that the 
improvements to the high- 
availability features made in 
WebSphere Application Server 
6.0 can now be leveraged on 
the mainframe. 

IBM also made available 
CICS Transaction Server for 
z/OS 3.1, she said, which uses 
Web services to extend CICS 
applications into service-orient- 
ed architecture environments. 

In addition, Rusting said, 
the company has extended the 
SCM capabilities of its Rational 
tools for zSeries and has made 
ClearQuest the single point of 
control for managing change 
across the mainframe and dis- 
tributed systems by integrating 
it with Software Configuration 
and Library Manager (SCLM) 
Plus, the asset management 
tool for z/OS. I 



run a medical practice, that 
include mobile devices. A doc- 
tor might use a handheld .NET 
device to communicate with a 
patient's insurance company, he 
said. Because 2.6 supports 
WSE 2.0, developers no longer 



have to write the code needed 
to make that connection. 

Hessinger noted that rules 
engines originated in the Java 
camp, but in the past year they 
have begun to make their way 
into the .NET world. Compa- 



nies such as ILOG have recent- 
ly launched .NET versions of 
their Java rules engines. But 
such offerings still rely on a 
dedicated server running J2EE, 
which can slow performance in 
the .NET environment, he said. 



By contrast, InRule, written in 
C#, was architected for .NET 
from the ground up. 

InRule 2.6, which starts at 
US$14,600, boosts perfor- 
mance by fetching rules on an 
as-needed basis, instead of 
accessing the entire set of rules, 
regardless of whether they will 
be used, Hessinger said. I 
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TIBCO Gets Down to BusinessEvents 



BY EDWARD J. CORREIA 

Sometimes there is order in 
chaos. On April 18, integration 
tools vendor TIBCO Software 
released BusinessEvents, a suite 
that it says lets developers add 
business rules and logic onto 



correlated events and data as 
they flow through the enter- 
prise, enabling applications that 
can help avoid threats and iden- 
tify opportunities in real time. 

"Often when a situation is 
about to happen, there are clues 



that people are not able to pick 
up on," said Alan Lundberg, 
senior product marketing man- 
ager at TIBCO, adding that fre- 
quently such problems or 
opportunities are identified too 
far after the fact to be avoided or 



seized upon. "They usually use a 
batch process overnight, and 
they find out what's happened 
too late," he said. 

While TIBCO's tools previ- 
ously offered some risk aversion 
capabilities through business 
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rules, Lundberg said the ability 
to instrument enterprise events 
has been lacking. "Now you can 
take granular events, correlate 
them into larger, complex events, 
provide rules around them and 
act upon them in real time." 

He said that in addition to 
risk avoidance, some target 
applications might include SEC 
and general compliance, fraud 
detection and apps for financial 
and telecom industries. 

According to Lundberg, the 
software is based on Complex 
Event Processing (CEP), a theo- 
ry published by Stanford Univer- 
sity professor David Luckham. 
CEP expands on Stanford's Rapi- 
de project involving concepts of 
casual event modeling, event pat- 
terns and matching, and event 
mapping. 

"It's kind of like Pavlovian 
conditioning," Lundberg said. 
"It's built around complex adap- 
tive systems; as an organization 
learns new information from 
complex events, it responds pro- 
grammatically through business 
rules." TIBCO has been working 
on this new area of technology 
for about two years, Lundberg 
said; pricing for a typical deploy- 
ment is expected to start at about 
US$100,000. 

THREE-PART SOLUTION 

Available now for Windows and 
Solaris, BusinessEvents consists 
of an events server for instru- 
menting and correlating enter- 
prise messages, an inference 
and rules engine for adding 
rules and logic, and a state 
machine, which Lundberg said 
monitors the rules and process- 
es as they run their course. 

For example, an order 
process might first involve a 
credit check, an inventory check 
and a pack-and-ship stage. "You 
can follow this process as it 
changes state, and associate each 
state with a certain time," he 
said. "If an event doesn't happen 
on time, you can trace it and find 
out where it failed." Visualization 
tools include those for portals, 
Web pages and dashboards; 
Java-based reporting mecha- 
nisms also are supported. 

BusinessEvents can be fed in 
any number of ways, Lundgard 
said, including of course by 
TIBCO's own integration and 
messaging servers. "We work out 
of the box with Rendezvous and 
EMS. You can also use our API 
to write custom channels to hook 
into any number of things," such 
as IBM's MQ Series and other 
messaging protocols and data 
streams. I 
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Sybase: RFID From Soup to Nuts 



BY EDWARD J. CORREIA 

Sybase in mid-April released RFID 
Enterprise, a trio of tools designed to 
permit enterprise developers to gather, 
consume and integrate data as it comes 
in from devices tracking items tagged 
with radio frequency identification. 

The suite builds on a foundation 
Sybase laid in February with the release 
of RFID Anywhere, Windows server tools 
and middleware for building control and 
management logic for RFID devices in a 
supply chain. "RFID Anywhere itself 
doesn't actually consume the data," said 
Marty Mallick, a senior product manager 
at Sybase, but merely collects and passes 
it off for integration to BizTalk, JMS or 
another server. When sold as a compo- 
nent of RFID Enterprise, the US$30,000 
RFID Anywhere is called RFID Edge- 
ware; it runs only on Windows XP servers. 

For another $20,000, Sybase claims 
the trio of integration components for 
Linux, Solaris and Windows servers 
includes everything necessary to con- 
sume the RFID data and integrate it 
with enterprise systems. "It extends 
RFID Anywhere to propagate the data 
to any business application running 
within your organization," he said. 

First of the three is RFID Business 
Process, Integration and Monitoring, 




RFID Enterprise provides a visual environment for creating item-tag data flows. 



described as a visual environment for cre- 
ating maps and transformations between 
RFID data and business systems. It per- 
mits business rules to be added and can 
monitor data streams and events to trigger 
others. The module also includes prebuilt 
adapters, including those for Oracle, SAP 
and PeopleSoft. "This allows you to find 
the end points of where that data's going 
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and programmatically manipulate or 
change the data along the way," Mallick 
explained, adding: "It also gives you a 
framework to build your own adapters to 
back-end systems." 

Data persistence is provided by the 
RFID Open Database Schema and Persis- 
tence Layer component, which Mallick 
described as a predeveloped SQL schema 
that developers can use to map incoming 
RFID data to their own SQL database to 
give the data some meaning. 

"The data coming off an RFID network 
is binary and hex code. A human [cannot] 
read it and say, 'Hey, we're low on invento- 
ry somewhere,' because you're not even 
going to understand what the item is. The 
data persistence component allows you to 
map the RFID tag data to the actual busi- 
ness items or assets you are monitoring and 
persist it into a SQL database," he said. 

Also included is RFID Reporting, a 
custom reporting environment that 
Mallick said also delivers a few canned 



The suite propagates RFID Anywhere data to 
any business app, says Sybase's Mallick. 

reports. "The end result is that we offer 
a soup-to-nuts RFID deployment, from 
physical device management, getting the 
data from the hardware, filtering and 
aggregation, all the way up to propaga- 
tion into enterprise systems." 

Mallick claimed that what sets RFID 
Enterprise apart from most competitors is 
the ability of Edgeware to filter out the 
huge amount of data flowing across an 
RFID network, most of which is not 
meaningful. "If you're scanning inventory 
items in a warehouse every 10 seconds, an 
enterprise system doesn't need to know 
an item is 'still there, still there, still there.' 
By providing aggregation and filtering at 
the reader level, Edgeware can effective- 
ly take out all the unnecessary data before 
we send it onto the network." 

He added that Sybase is among only a 
handful of RFID vendors to support 
EPC- and ISO-standard tags in a single 
solution. "Wal-Mart is a huge backer of 
EPC Global specifications, but many oth- 
er businesses are not; they use ISO. We 
support both. You don't see that too 
often, even among the pure-play RFID 
vendors." I 



PERSISTENT, ISPHERES 
SPAWN RFID SOLUTION 



Data infrastructure company Persistent Systems has teamed with real-time event 
server developer iSpheres to deliver what the companies claim is a complete solu- 
tion to allow developers to build networks that track, store and analyze data flow- 
ing in from items in a supply chain affixed with radio frequency identification tags. 
The solution became generally available on April 26. 

According to Carole Meagher, director of marketing at iSpheres, the solution 
gives enterprise developers and integrators a blank slate for targeting such verti- 
cal markets as logistics, manufacturing, pharmaceutical and retail with real-time 
analytics applications. Meagher described how the company's EPL Server, when 
linked with RFID readers and RFID-tagged merchandise, can be used to analyze and 
respond to customer patterns in real time. "If you want to try different displays of 
high-margin products, you can know in real time if products are moving, or if peo- 
ple are just picking up products, looking at them and putting them back. That's one 
type of granular use of RFID for analyzing consumer behavior." 

Another use, Meagher said, could be for developing security applications by 
tracking tagged items throughout a building. "So if a liquor bottle suddenly winds 
up behind the bread, then later with the soup, it's possible that an employee is try- 
ing to steal it, or worse, drinking it during their break." —Edward J. Correia 
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ThinkCAP 



ThinkCAP 6.0 simplifies and accelerates the development ant 
maintenance of J2EE-based web applications by 50% r 
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Download a free trial version or view a demo at www.cfearnova.com. 
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Apache Turns Users Into Mavens About Projects 



BY DAVID RUBINSTEIN 

The ability to manage a large 
set of the projects at the same 
time has been built into the 
core of Maven 2.0, the open- 
source project and build man- 
agement tool from the Apache 



Software Foundation. 

According to Jason van Zyl, 
founder of the Maven project, 
while that capability existed in 
rough form in Maven 1.0, this 
version tightens the integration, 
and brings such things as con- 



tinuous integration into Maven s 
project object model (POM), 
which van Zyl said is the key 
feature in Maven. "It's a safety 
net for developers," van Zyl 
said. "It helps find problems 
introduced into the project 



when builds fail, and alerts the 
developer who introduced the 
problem. It's extremely impor- 
tant in test automation." 

The POM is a description of 
the project, such as the organi- 
zation it belongs to, which 




developers are on the project, 
where source code is or where 
tests are, van Zyl said. Then, in 
Maven 2.0, a Web site can be 
generated automatically with 
that information, and reports 
can be drawn from it, he added. 
Another expanded feature in 
Maven 2.0, van Zyl said, is 
archetypes, which are small pro- 
ject prototypes. "These are tem- 
plates that can get users up and 
running quickly," van Zyl said. I 

Surgient Package 
Provisions Test 
Configurations 

BY YVONNE L. LEE 

Surgient, a company that 
specializes in hosted manage- 
ment applications, late last 
month released a service de- 
signed to tackle the problem of 
testing software under various 
configurations. 

"In the realm of testing, if a 
test organization has to run, say, 
a functional test, they basically in 
batch mode send a request to an 
operations support group [for 
the appropriate configuration]," 
said vice president of marketing 
Erik Josowitz. "There's no ability 
for a test organization to effec- 
tively serve themselves." 

The new service, the Virtual 
Q A/Test Management System 
(VQMS), is available as a hosted 
service or as a licensed package 
that a company would use with 
its own hardware behind its 
firewall. Pricing for the licensed 
package begins at US$75,000 
for 25 users. 

In either case, users of the 
product select the hardware 
and software configurations 
that they want to test using a 
Web-based interface. 

Users can select the type 
and number of processors to 
host an application, as well as 
the disk space and memory. In 
addition, they can run function- 
al tests and configure the num- 
ber and types of client systems. 
These configurations can be 
saved and reused. 

Surgient s software provi- 
sions the computer. It uses 
technology from VMware to 
run the virtual computers. 

VQMS also has software 
libraries and customization 
tools for organizations to create 
test scripts, as well as schedul- 
ing software to run them at 
specified or repeated times. 
VQMS also will run tests from 
Mercury, Rational and Segue in 
addition to its own scripts. I 
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Fusing Work Processes Into Composite Applications 

Jacada's updated platform adds J2EE Web services orchestration 



BY DAVID RUBINSTEIN 

A partnership with BEA has 
resulted in Jacada's providing a 
default J2EE environment 
under its Fusion 2.0 composite 
application platform, released 
April 18, with updates to its Win- 
Fuse, WebFuse and HostFuse 
service-enabling tools, which 
handle Windows, Web or main- 
frame applications, respectively. 
Fusion "is less about an indi- 
vidual application s ability to sup- 
port a process as it is about five 
or 10 applications' ability to sup- 
port a process," said Rob Morris, 
vice president of product strate- 
gy. The platform can create a 
composite application from 



THE TOOLS 



WinFuse: Turns Windows 
interactions into Web services. 

WebFuse: Records browser 
interfaces for use with J2EE, 
.NET. 

HostFuse: Maps Web services 
to host screens/keystrokes. 

applications residing on main- 
frames, servers or on the Web, 
Morris said, and has been used 
effectively in call centers, where 
service representatives have to 
juggle CRM applications with 
mainframe-based apps, for ex- 
ample, to complete their task. 

Morris gave the example of a 
caller who wants to pay off a 
credit-card bill. The service rep 
first must take information and 
verify it against a Windows- 
based CRM system, and then 
check the balance against a 
mainframe-based financial app. 

What WinFuse and HostFuse 
do in this instance, Morris 
explained, is record the interac- 
tions and save them as scripts 
that become the services founda- 
tion of a single app that the 
Fusion engine drives through the 
requisite screens to complete the 
transaction. "Generally speaking, 
it's all screen-scraping, but for 
each platform the solution pro- 
vides a more robust way to main- 
tain a connection [to the apps] 
through the user interface." 

Fusion now uses BE As 
WebLogic application server to 
orchestrate the Web services 
produced by the WinFuse, Web- 
Fuse and HostFuse tools, Morris 
explained. Those engines com- 
municate to the applications via 
Citrix or Windows Transaction 
Server, HTTP/S, or host termi- 



nal emulation, respectively, and 
then back to the Web services 
sitting on the app server. Fusion 
now also provides a unified 
installation of all the compo- 



nents, and capabilities for man- 
aging the composite application 
and its underlying components 
from the single interface. Pricing 
for a Fusion implementation 



starts at US$50,000. 

"We give a single view of a 
customer, an interaction or a 
process, but what we don't do is 
say that a single view is the solu- 



tion. Everything starts with the 
process or task," Morris said. 

Jacada also had revamped 
WinFuse to work as a plug-in 
to Visual Studio, Morris said. 
WebFuse has an enhanced 
graphical modeling environ- 
ment, and HostFuse now in- 
cludes a visual debugger for the 
recording sessions. I 
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C# Held in Chains, 
Java Stays Nimble 



< continued from page 6 

were used to them so they 
designed them into the lan- 
guages, and they really shouldn't 
be there. 

"Generics offer a different 
way to look at programming, an 
alternative way to do similar 
things," Holub continued. "The 
question becomes whether a 
single language should be doing 
both, because the programmer 
starts losing focus and the pro- 
grams start getting hard to 
maintain, because they mix fun- 
damental metaphors into a sin- 
gle program that becomes hard 
to understand." 

O'Brien agreed, in terms of 
both Java and C#. "As the lan- 
guages get older, they get more 
and more complex and lose one 
of their greatest appeals, which 
was that they are supposed to 
be easy to learn and use." 

"Java has consciously focused 
on not doing that," said Holub. 
"That's one of the reasons that 



generics were so controversial 
before they became part of the 
language. In Java the general 
philosophy is that it's better to 
add libraries than to modify the 
language to do that kind of 
stuff." 

And what about adding C#'s 
iterators, anonymous methods 
and partial types to Java? 
"I don't know that we need 
them," Holub said. "I happen 
to like languages that are opti- 
mized for certain things like 
database access; I liked 
COBOL because it was opti- 
mized for printing reports from 
database tables. I'd rather have 
several languages that work 
together than have one giant 
language." 

O'Brien echoed Holub's 
sentiments. "I believe in a 
world with multiple languages 
that people use in different sit- 
uations. I prefer that to a port- 
manteau language that tries to 
be all things for everyone." I 



EPL 5.1: REDESIGNED 



A simplified, redesigned user interface is the main hallmark of EPM Studio, the latest design environment 
included with iSphere's EPL Server 5.1 real-time event processing system, which began shipping on April 18. 

Now business analysts can modify some aspects of applications, according to Carole Meagher, director of 
marketing at iSpheres. The tool offers automatic syntax checking and code optimization. Pricing starts at 
US$25,000 per server processor with a two-processor minimum. I 
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Announcing Eclipse World, 

the enterprise 

EclipseWorld is for enterprise developers, architects 
and development managers who want to take their 
company's applications to a higher level! 



Over 40 great classes to choose from! 



Sample Tutorials: 



Understanding the Eclipse Architecture 
Introduction to Using Eclipse on Windows 
Introduction to Using Eclipse on Linux 
Introduction to Business Intelligence 

Using BIRT 
The Eclipse Ecosystem: 

Tools and Plug-ins for Eclipse 
Introduction to Aspect-Oriented Programming With AspectJ 

Sample Classes: 

Advanced Java Development Using Eclipse Platform IDE 

Advanced C/C++ Development Using Eclipse Platform IDE 

Programming to the Eclipse Rich Client Platform (RCP) 

The Future of Eclipse: Walking Through the Road Map 

Integrating Eclipse With the Ant Build Tool 

Integrating Eclipse With CVS 

Deep Dive: Understanding the Eclipse Internals 

Graphical Development With Eclipse, GEF and SWT 

Collaboration Using Eclipse and WebDAV 

Web Services and Eclipse Using EMF 

Eclipse for COBOL Developers 

Advanced AOP With AspectJ 

Troubleshooting Eclipse 

Understanding the Eclipse Open-Source License 




Refactoring With Eclipse 
Building Strong GUIs for Eclipse Projects 
The Eclipse Debugger 

Modeling Using Eclipse and the UML2 Project 
Introduction to Web Development Using 
Eclipse and WST 

Advanced Web Development Using Eclipse 
and WST 

Interoperability Workshop: Eclipse Tools, .NET Platform 
How to Contribute to the Eclipse Project 
Data Visualization Using BIRT 
Advanced Reporting Using BIRT 
Eclipse Integration With Tomcat 
Using Eclipse With the Struts Framework 
An Open-Source Stack: Linux, Apache, MySQL, Eclipse 
How to Contribute to the Eclipse Project 
How to Build Eclipse Plug-Ins 
Software Testing With the Eclipse Framework 
Building Secure Applications Using Eclipse 
Database Integration Using Eclipse 
J2EE Development Using Eclipse and JST 
Web Development Using Eclipse and WST 
Panel: Open-Source and Intellectual Property 
Advanced JavaScript With Eclipse 
Panel: Meet the Eclipse Contributors: How Eclipse Works 



For sponsorship or exhibiting information, 

contact Donna Esposito at 415-785-3419 or desposito@bzmedia.com 



ipseWorld™ is a trademark of BZ Media LLC. Eclipse™ is a trademark of Eclipse Foundation Inc. 



www.eclipseworld.net 



development conference! 



Are you ready for Eclipse? 

Whether you're an Eclipse master, just getting started 
with the platform, or trying to decide if Eclipse 
technologies are right for your development team, 
the EclipseWorld Conference & Exhibition is the 
#1 educational event that you should attend this year. 



EclipseWorld attendees will: 

• Save money and improve developer productivity 
with Eclipse. 

• Go beyond the IDE to master the wide range 
of Eclipse technologies. 

• Discover the best, most effective Eclipse add-ins 
and plug-ins. 

• Master techniques for building high-quality, 
more secure software. 

• Get deep inside Eclipse's open-source architecture. 

• Improve team collaboration using Eclipse. 



"Eclipse is pleased to welcome 
BZ Media's launch of EclipseWorld," 

said Mike Milinkovich, executive director of the Eclipse 
Foundation. "Adoption of Eclipse-based tools and technologies 
is on the rise, and developers and development managers are 
looking for education and training. We think that it's important 
that leading-edge media companies like BZ Media are taking 
the initiative with this enterprise-focused conference/' 
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BZ Media is a member of the 
Eclipse Foundation. 
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WebMethods Softens Fabric Interface, Predicts Snags 



BY EDWARD J. CORREIA 

Integration tools developer 
WebMethods this summer plans 
to release Fabric 6.5, the latest 
version of its flagship platform 
introduced in October 2004 that 
it says offers a friendlier inter- 



face for use by nondevelopers, 
drag-and-drop assembly of 
business applications and pro- 
cesses, and enhancements to its 
SOA capabilities for predictive 
tracking of quality of service 
throughout the enterprise. The 



upgrade will be free for cus- 
tomers with current mainte- 
nance agreements. 

"Traditional approaches 
don't deliver for the business 
fast enough," said WebMethods 
president and CEO David 



Mitchell, in a statement, refer- 
ring to business process inte- 
gration solutions offered by 
competitors. "Companies are 
looking for a way to close the 
gap between business require- 
ments and IT execution. Fabric 
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6.5 accelerates the delivery of 
these applications and the intel- 
ligence built into the system." 

New features in Fabric 6.5 
aimed at delivering such func- 
tions include an enterprise SOA 
framework, which reportedly 
delivers Web services manage- 
ment and brokering capabilities 
to deliver feedback on events as 
they occur. "This provides orga- 
nizations with an ability to know 
what is happening in their busi- 
ness now and to predict what is 
coming next," Mitchell said. 
Monitoring technology contin- 
uously compares current events 
with historical patterns and can 
alert users to potential issues or 
problems. 

According to the company, 
which unveiled its new plat- 
form at Gartners Application 
Integration and Web Services 
Summit in Los Angeles last 
month, new metrics for moni- 
toring and management enable 
developers to more easily per- 
form iterative adjustments on 
their business processes. I 

Adobe Acquisition 
Won't Impact Core 

-4 continued from page 1 

of PDF text and graphics files 
and animation. 

"Customers are calling for 
integrated software solutions 
that enable them to create, man- 
age and deliver a wide range of 
compelling content and applica- 
tions — from documents and 
images to audio and video," said 
Bruce Chizen, chief executive 
officer of Adobe, in a statement. 
"By combining our powerful 
development, authoring and col- 
laboration software — along with 
the complementary functionality 
of PDF and Flash — Adobe has 
the opportunity to bring this 
vision to life with an industry- 
defining technology platform." 

Lynch said the company's 
tools are complementary, citing 
Adobes video editor for creat- 
ing video that can be delivered 
in the Flash player as an exam- 
ple. "It goes beyond the tradi- 
tional tools everyone thinks of," 
Lynch said. 

Adobe, which employs about 
3,700 people and posted rev- 
enue of $1.29 billion in 2003, 
expects to complete the deal by 
fall, pending the approval of 
shareholders and federal regula- 
tors. Chizen will remain CEO in 
the combined company. Macro- 
media CEO Stephen Elop will 
become president of worldwide 
field operations. I 
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Borland: No Developer Left Behind 



the other for Eclipse. Borland 
has said earlier that it also 
plans to deliver a view for 

Next Delphi release to include C++Builder, support for Core SDP NET but Swi,lde11 did ,10t 



< continued from page 1 

will be able to see information 
pertaining to other roles (and 
vice versa) without firing up 
separate products, he said. 

Swindell also offered a 
glimpse of the next version of 
Delphi, expected to incorpo- 
rate C ++Builder. Borland said 
last December that it will no 
longer sell C ++Builder as a 
separate product, but until 
now the company had not said 
what the new, combined offer- 
ing will look like. "Developers 
will be able to choose 'filenew 
Delphi' or 'filenew C + + ,' or 
open an existing file for either 
project." The experience will 
be the same as using C++ 6 
and Delphi 2005, he said, 
referring to the current ver- 
sions of each. 

"Our C + + Builder cus- 
tomers view Delphi as a sib- 




Delphi and C++Builder each has a 
following of about a million active 
developers, says Borland's Swindell. 

ling," Swindell said, noting 
that the C++ offering shares 
Delphi's Visual Component 
Library (VCL). Borland ex- 
pects to deliver the next 
release of Delphi next year, 
but Swindell did not offer fur- 
ther details. 

BORLAND'S ROOTS 

Delphi and C++Builder each 
has a following of about 1 mil- 
lion active developers world- 
wide, said Swindell. Launched 
in 1995, Delphi was the succes- 
sor to Turbo Pascal, Borland's 
1983 offering, delivered the 
same year the company was 
founded. In addition to the Pas- 
cal programming language, 
Turbo Pascal included an edi- 
tor, debugger, compiler and 
windowing library and is widely 
considered to be the first inte- 
grated development environ- 
ment. Delphi added support for 



rich-client Windows applica- 
tions and database connectivity, 
Swindell said. "At the time 
[Microsoft's] Visual Basic wasn't 
a compiler, so Delphi, which 



created actual executable Win- 
dows apps, was a big deal." 

Delphi has since evolved to 
support .NET C++Builder was 
launched in 1996, and is based 



on the earlier 1987 offering, Tur- 
bo C++. 

Core SDP currently sup- 
ports two versions of Core 
Developer, one for JBuilder, 



specify when. 

No matter what tool the 
developer wants to use, "data 
will feed up into Core SDP 
and feed down as needed," he 
said. I 
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Array of Security Offerings Is Expanding 



< continued from page 1 

was sponsored by SD Times' 
parent company BZ Media, 
Pittsburgh-based LogicLibrary 
announced Logiscan 2.0, an 
updated and renamed version 
of the company's former offer- 
ing, BugScan, designed to 
examine binary code to pin- 
point possible flaws. 

SPI Dynamics, based in 
Atlanta, delivered SecureOb- 
jects 1.5, which plugs into 
Microsoft Visual Studio to scan 
and repair source code 

And Cleveland-based Pre- 
Emptive Solutions was to 
announce on April 25 updated 
versions of DashO for Java and 
Dotfuscator for .NET, adding 
software watermarking capabili- 
ties to both tools, which are 
designed to make it difficult for 
hackers to decompile apps. 

BYE r BYE 'BUGSCAN' 

Changing the name from 
BugScan to Logiscan better 
aligns the scanning tool, 
acquired last year, with Logic- 
Library's data repository for 
software assets, Logidex. The 
two offerings are now integrat- 
ed, said Ralph Massaro, general 
manager of content products, 
enabling automatic scans of 
assets stored in the repository. 
BugScan examined C and C+ + 
code, but Logiscan 2.0, which 
costs US$45,000 per server, 
adds support for Java code and 
Sun SPARC binaries. 

Also new is a three-dimen- 
sional visualization feature that 
graphically depicts an applica- 
tion's classes and methods and 
the modules that contain them. 
It highlights potential security 
flaws in green, red and yellow, 
depending on the degree of 
severity. By right-clicking on a 
red point, for example, a devel- 
oper can find out that the data is 
tainted, and determine whether 
it originated from a cookie or a 
URL request, said Matt Har- 
gett, LogicLibray's director of 
security product development. 

Many application scanners 
are designed to examine source 
code, noted Massaro. But 
because Logiscan looks at bina- 
ry code, it also can find flaws in 
off-the-shelf applications, not 
just those developed in house. 
"Code is code," he said. "Nei- 
ther source code analysis nor 
binary analysis has the leg up on 
finding bugs." 

SecureObjects, SPI Dynam- 



ics' first foray into source code 
analysis, scans the source code of 
Web applications developed in 
Visual Studio, aiming to make it 
easier for .NET developers to act 
or not on the advice it delivers. 

For instance, SecureObjects 
might tell the developer: "It looks 
like you are trying to input a tele- 
phone number here. Would you 
like to replace the code with 
SecureObjects' [code]?" said 
SPI's CEO and president, Brian 
Cohen. "You can use the secure 
code, write your own fix, or sim- 
ply take note of what [the pro- 
gram] is telling you." 

In addition to pinpointing 
potential problems with how 
Web users enter data into forms, 
SecureObjects identifies weak- 
nesses such as error messages 
that inadvertently reveal too 
much information. "When an 
error message tells them they 
are denied access to a file, hack- 
ers think, 'Okay, I know that file 
is there,' " he said. 

SecureObjects 1.5, which 
costs US$1,495 per user, 
replaces 1.0, which the compa- 
ny delivered in November 
2004. New to 1.5 is the ability 
to create an audit trail of each 
user's actions, giving develop- 
ment team managers the big 
picture on what code has been 
scanned and what fixes have 
been made. The larger goal is to 
educate developers in secure 
coding practices, so QA profes- 
sionals who use SPI Dynamics' 
Weblnspect to simulate attacks 
on Web applications won't find 
any flaws, said Cohen. 

Weblnspect, which the com- 
pany has sold since 2000, sup- 
ports both Java and .NET, but 
Cohen did not specify when the 
company will deliver a Java ver- 
sion of SecureObjects, original- 
ly promised for last year. 

Like Weblnspect, NT Ob- 
jectives' NTOSpider works by 
simulating attacks on Web 
applications, finding and fixing 
holes before hackers exploit 
them. It examines "anything 
plugged into HTTP," including 
Java and .NET code, looking 
for "parameters that could be 
tampered with by hackers," said 
JD Glaser, president and CEO 
of the privately funded start-up. 

NTOSpider, which costs 
US$8,000 per user, spots 
potential openings, such as 
opportunities to access data 
intended to be off-limits by 
injecting SQL code into a Web 



form, for example. It provides 
reports that summarize the 
errors found, and offers advice 
on how to fix them and which 
ones demand the most imme- 
diate attention, said Glaser. It 
also generates a map of a Web 
application, highlighting weak 
spots where threats could 
occur. NT Objectives augments 
its tool with service offerings 
aimed at helping teams inte- 
grate secure coding and testing 
practices into the development 
process. Application security is 
more than just scanning code 
or running simulation tests, 
Glaser said. 

SOFTWARE WATERMARKING 

Neither code scanners nor sim- 
ulation testing tools, PreEmp- 
tive's DashO for Java and Dot- 



fuscator for .NET aim to 
strengthen applications with 
capabilities such as encryption 
to make them difficult to 
decompile, and, thus, exploit. 
"Java and .NET applications 
are both easy to reverse-engi- 
neer," said PreEmptive presi- 
dent Gabriel Torok, noting the 
wide availability of open-source 
tools designed to get the source 
code out of applications. 

New to both DashO 3.2 and 
Dotfuscator 3.0 is software 
watermarking, which hides 
crucial information. The U.S. 
Department of the Treasury 
uses watermarks to prove 
authenticity and thwart coun- 
terfeiting of paper currency, 
said Torok. "Digital water- 
marking does the same for 
electronic data. The object, or 



'carrier,' can be an image [such 
as a jpeg file], an audio file 
[such as an mp3] or a binary 
executable." 

Dotfuscator and DashO, 
which cost US$1,495 per seat, 
can now embed hidden infor- 
mation, such as a copyright or a 
customer identification num- 
ber, directly into a Java or .NET 
application, he said. Once the 
data is embedded, the Pre- 
Emptive tools output at build 
time a functionally equivalent 
version of the application, with 
protected code that "hides" the 
copyright or customer number 
from hackers. 

Software watermarking is 
especially useful to ISVs, 
enabling them to hide unique 
serial numbers for software, 
Torok said. I 



Instantiations Swings Both Ways 



BY YVONNE L. LEE 

WindowBuilder, Instantiations' 
graphical user interface devel- 
opment tool, last month was 
upgraded so that Eclipse SWT 
windows can use Sun's Swing 
widgets. 

According to vice president 
of marketing Mark Johnson, the 
previous version made it possible 
for developers to use both Swing 
and SWT, but not within a single 
interface. Now, in Window- 
Builder 4.0, SWT and Swing 
components can be mixed so 
that Swing widgets can be 
embedded into SWT windows. 

"That's important because 
with SWT being relatively new, 
there isn't tremendous support 



in the widget world," said John- 
son. "The ability of a developer 
exists to create an SWT-based 
application using SWT layout 
manager, and you can take a 
Swing widget." 

"Swing is basically a user 
interface kit for Java," explained 
Brian McCallister, architect at 
Chariot Solutions, a consulting 
firm in Fort Washington, Pa. 
McCallister has not used Win- 
dowBuilder, but works with both 
Swing and SWT. "[Swing] tends 
to lag behind what a user inter- 
face actually looks like, but it also 
is standard. SWT uses native 
widgets, but it hasn't been 
around as long, and there isn't as 
much support for it, but it gives 



you a much snappier appear- 
ance." McCallister said a prod- 
uct like WindowBuilder that 
commingled Swing elements 
and SWT could be used to share 
components that have already 
been developed, but added that 
a product that did the reverse, 
adding SWT elements to Swing 
windows, also could be useful for 
updating the appearance of 
existing applications. 

Also new in version 4.0 is 
support for JGoodies FormLay- 
out for creating Swing form 
windows. 

The US$299-per-developer 
WindowBuilder Pro installs 
into any Eclipse-based develop- 
ment tool, Johnson said. I 



CA Dev Tools Take Back Seat 



< continued from page 1 

software provider Netegrity, CA 
"now can go head-to-head with 
HP," he claimed. 

Unicenter now falls into the 
company's new Enterprise Sys- 
tems Management business 
unit, headed by Alan F. Nugent, 
the former chief technology offi- 
cer at Novell. Nugent joined CA 
early last month. The other four 
business units are security man- 
agement, storage management, 
business service optimization 
and the CA products group, 
headed by Mark Combs. 

Rob Levy, who formerly led 
development of the AllFusion- 
branded life-cycle tools, will 
lead a new Center for Technolo- 



gy Strategy, responsible for exe- 
cuting on the company's vision 
and strategy. By emphasizing 
network management and secu- 
rity, Artzt indicated that the 
company is not looking for big 
growth from its existing tools, 
but will continue to develop and 
maintain them and provide sup- 
port to their customers. 

The products group, accord- 
ing to Artzt, is where a number 
of products that are not essential 
to the company's core but are 
important to large customers will 
be placed. He said the COOL 
tools will be in this group, as will 
other nondeveloper products 
that CA plans to continue. The 
Erwin data modeler will be 



packaged in with Unicenter, 
while the Harvest and Endeavor 
change management tools will 
go in the business service opti- 
mization category, he said. 

Aion, the company's business 
rules and process management 
system, is being integrated 
across all core business units. 
Artzt acknowledged that CA "is 
not really pushing its UML mod- 
eling tool" any longer. 

"There are some products 
that are just good, that are not as 
directly in the core but have a 
strong base and are highly prof- 
itable," Artzt said of CA's devel- 
oper tools. "We will continue to 
maintain and develop those tools, 
and take good care with them." I 
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Wind River Details Planned Eclipse Project 

Subprojects to include GUI-based target management, hardware bring-up tools 



BY JENNIFER DEJONG 

Betting that Eclipse can do for 
embedded development what 
Eclipse has done for Java, Wind 
River Systems last month 
offered a further glimpse of its 
proposed Eclipse project, first 
discussed at the Embedded Sys- 
tems Conference in early March. 

Led by Wind River, the 
Device Software Development 
Platform (DSDP) project is 
expected to include two subpro- 
jects: target management and 
hardware bring-up, said Rob 
McCammon, director of prod- 
uct management for the Wind 
River Development Suite. 

Target management aims to 
provide tools to ease the 
process of developing for multi- 
ple environments simultane- 
ously. It is likely to include a 
GUI component, allowing a 
developer to more easily con- 
nect the targeted device or 
devices to the desired operating 
system and processor, without 
having to write the code. The 
hardware bring-up subproject 



is expected to provide standard 
interfaces for developing hard- 
ware and software in parallel. 
Eclipse has created a large 
ecosystem around Java applica- 
tion development, McCammon 
said. "But there is no place 
within Eclipse that [provides] 
the right stuff for device soft- 
ware development." Still in the 
proposal stages, DSDP aims to 



do that. The time frame for 
delivering tools based on the 
two subprojects has not yet 
been set, he said. 

PARALLEL TOOLS 

In related news, the Eclipse 
Foundation announced last 
month the Parallel Tools Plat- 
form Project. Led by the Los 
Alamos National Laboratory, 



the project aims to provide 
standards-based tools for devel- 
oping the large, complex appli- 
cations used in industries such 
as defense and weather fore- 
casting, said Mike Milinkovich, 
executive director of Eclipse. 
Such tools are expected to 
replace the current array of 
open-source and commercial 
offerings for parallel develop- 



ment, which don't interoperate 
with one another. The project is 
expected to begin delivering 
tools in September. 

Parallel Tools and DSDP are 
two examples of how the 
Eclipse framework is maturing 
beyond a purely Java focus, said 
Mike Milinkovich. "We will 
continue to deliver on that 



Linux SDK Subtracts Spyware 

InterMute targets appliances with variant of Windows tool 



BY EDWARD J. CORREIA 

Internet security solutions 
developer InterMute last 
month released a Linux edition 
of SpySubtract SDK that it says 
allows developers to add spy- 
ware detection capabilities to 
their Linux-based network 
applications and security 
devices, in essence subtracting 
malicious files from the net- 
work as they try to cross the 
firewall. 



"It enables applications to 
have the capability to scan 
[incoming data streams] and 
determine whether a file is spy- 
ware or not without having to 
write their own code," explained 
Kiron Cochuvelu, the compa- 
ny's principal software engineer. 
The software also takes care of 
downloading new spyware defi- 
nitions and maintaining its own 
database, he said. The software 
is implemented as a library that 



works with a developer's exist- 
ing tools. Pricing is negotiated 
by project. 

Unlike its Windows counter- 
part, which was released last fall 
and is aimed at building desktop 
apps, the Linux edition contains 
no scanning engine, and is 
intended more for devices, said 
Andy Ostrom, director of market- 
ing at InterMute. 

Cochuvelu said that while the 
solution can be used for general 



development, it's best suited for 
building so-called edge devices: 
Linux-based rack-mount servers 
performing security tasks at the 
network perimeter. The tool also 
helps developers focus on their 
own core strength. "It removes 
the burden of [learning] how 
to decide, update and distribute 
spyware database data," added 
Ostrom. 

Ostrom said that developers 
building other, similar types of 
solutions, such as anti-virus 
software, can use the tools to 
easily add anti-spyware capabil- 
ities into a single integrated 
solution. I 



Enea on OSE 5.1: Virtually Improved Memory 

Company claims to simplify development, nix memory fragmentation 



BY EDWARD J. CORREIA 

Enea Embedded Technology in 
early April took the wraps off 
OSE 5.1, the latest version of its 
real-time operating system that it 
says simplifies development by 
way of virtual memory support, 
dynamic program loading to per- 
sistent memory and improved 
configuration and build tools. 

Although dynamic program 
loading was supported previous- 
ly, Mike Christofferson, Eneas 
director of product marketing, 
said the added ability to store 
those components to persistent 
memory is not insignificant. 
"That allows OSE to maintain 
memory even through a warm 
start. That's important for wire- 
less and other devices that are 
turned on and off frequently, 
because it maintains consistency 
of data even if you shut it down." 

Further, OSE previously 
supported program loading 
only from a network or other 
file system, only into RAM and 
only for immediate execution. 
Now program loads can come 
from any source and be stored 
in a flash file system for subse- 




OSE 5.1 now offers memory protection and address translation through 
hardware MMUs. 



quent execution, he said, sim- 
plifying upgrades to devices in 
the field and providing backup 
when reboot is required. "If you 
didn't have that, all your appli- 
cations would have to be loaded 
from the network, which some- 
times is not available." 



Another major advance, 
according to Christofferson, is 
support for virtual memory, 
which he said permits applica- 
tions to address memory spaces 
beyond the 4GB boundary of 
32-bit processors, and intro- 
duces the memory protection 



and address translation of hard- 
ware MMUs. This gives devel- 
opers what Christofferson said 
is a more modular and flexible 
programming platform, unlike 
the monolithic environment of 
most other RTOSes. "Like in a 
desktop system, for instance, if 
you want to update or change 
an application, you don't have 
to rebuild and restart the whole 
system." 

However, unlike desktop 
operating systems, OSE 5.1 also 
manages the memory vacated 
by unloaded applications. "As 
you remove an application, it 
leaves a gap in memory. When 
you load another one that's big- 
ger than that gap, you have to 
stick it at the end. What you 
end up with is a bunch of little 
gaps that are hard to fill, like a 
fragmented disk." He said vir- 
tual memory solves that prob- 
lem with logical addresses, 
which are mapped to available 
physical memory. "Memory 
doesn't have to be contiguous, 
so it can fill in those gaps. It's a 
much more efficient and 
sophisticated way of doing it 



and makes it easier to develop 
with OSE." 

Pricing for OSE 5.1 starts at 
US$17,000, including a stack 
and file system plus per-device 
royalties. Enea also now offers a 
subscription option. 

PARTIAL ECLIPSE 

The company also has begun 
porting its development tools 
to Eclipse; it is shipping an 
OSE-aware version of the 
GNU debugger, and supports 
the C Development Toolkit. 
"It's a modest start, but we're 
moving in that direction," 
Christofferson said. Pricing 
starts at $2,000 per seat. 

He said the company is well 
along in improving its sample 
code and build tools. "Instead 
of providing simple examples, 
we provide almost complete 
reference systems with very 
sophisticated examples of OSE 
and all of its functionality. Just 
download and it runs, and it's 
ready for you to begin adding 
your applications." What's 
more, prototyping is further 
simplified by components that 
are configured at runtime using 
text-based configuration files. 
"These allow you to change the 
parameters and behavior of a 
system without having to 
rebuild the whole system." I 
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BY SUSAN MESSENHEIMER AND CAROL WEISZMANN 



r . ervice-oriented architectures are 

changing the face of enterprise 

k IT, provoking concern about how 

J SOAs will affect database opera- 

im -r^ tions. 

We contacted several developers and 
managers in industries ranging from 
health care to finance and asked them 
what they wanted to know from vendors 
about the impact of service-oriented 
architectures on data access and inte- 
gration. From this we derived seven 
questions. 

What do SOAs — which seem focused 
on the application level — mean for 
data access and integration? 

A lot, according to these vendors. 
Indeed, data integration is "a key com- 
ponent" of SOAs, according to William 
Hardie, senior director of database 
product marketing at Oracle. "Differ- 
ent databases or data stores can 
exchange data with one another using 
open standards that include Web ser- 
vices. And having a consistent data 
model enables seamless information 
access." 

Key to SOA success is standardizing 
data representation and access, accord- 
ing to several vendors. "The way in 
which data is formatted and stored — 
case sensitivity in names, use of dashes 
in credit-card numbers, etc. — needs to 
be fairly consistent for successful SOA 
implementations," noted Quest Soft- 
ware product architect Guy Harrison. 

Microsoft's SQL Server general pro- 
gram manager, Roger Wolter, believes 
that the isolation, flexibility and 
reusability benefits of SOAs "often 
require restructuring the underlying 
database." 

At Sleepycat Software, maker of the 
Berkeley DB open-source developer 
database, the view is that integration 
will be at the application or services 
level, not at the data level. "Each com- 
ponent needs to manage its own data 
reliably," explained Sleepycat market- 
ing vice president Rex Wang. "In a 




sense, data silos are the norm in an 
SOA world." 

Some SOA models call for a data tier 
that is service-enabled, asserted Com- 
puter Associates senior architect Paul 
Lipton. The advantage: Data services 
are abstracted from the business logic. 
"If properly designed" he said, "this 
frees the application tier from having to 
intimately know the data sources — and 
probably the APIs of those data sources. 
There are also potential benefits in 
terms of simplicity and abstraction from 
data source specifics." 

Rod Smith, IBM's vice president of 
software group emerging technologies, 
talked about an enterprise information 
bus that would accompany an enterprise 
services bus, providing "access to a vir- 
tualized world of information and a 



means to manipulate that information." 

Are we finally getting away from the 
one-giant-database mantra in favor 
of cheaper, faster interoperability 
fueled by Web services? 

Microsoft's Wolter thinks so. "Building 
loosely coupled services often requires 
breaking the tight integration of data so 
the services can be distributed across a 
number of independent databases," he 
said. But others dispute this view: CA, 
IBM and Oracle see a world with both 
monolithic and distributed databases, 
depending on the needs of the enterprise. 
J. T Taylor, senior director of XML 
business integration at Software AG, not- 
ed that few organizations can "afford to 
rip and replace, which is the first prereq- 
uisite for a single 'monster' database." 



Quest's Harrison sees utility/grid 
computing models offering the promise 
of being able to deal with "what appears 
to be one giant database, even if the 
actual data is spread across multiple 
physical instances." 

Will the implied virtualization of 
some architecture layers mean 
dynamic allocation of resources, and 
hence improved efficiency of the 
computing environment? 
Yes, yes, yes, agreed CA, IBM, Oracle 
and others. Still others cited conditions: 
"Only if you build the infrastructure to 
make use of it, and make sure that the 
ability to dynamically allocate is support- 
ed throughout your stack," said Zack 
Urlocker, open-source database devel- 
► continued on page 32 



32 



SPECIAL REPORT 



Software Development Times . May 1 r 2005 , 



www.sdtimes.com 



The Impact of SOAs on Data Access, Integration 



< continued from page 31 

oper MySQL's marketing vice president. 
"I think we are moving to a more on- 
demand, needs-focused data center," he 
said. "Computing power should be like 
electricity; the same is especially true for 
your database needs." 

Software AG's Taylor thinks this type 
of capability is some distance in the 
future. "In order to make this work, oth- 
er factors must first be addressed in a 
practical way — namely, security and 
accountability," he said. "Dynamic allo- 
cation also requires some smart piece of 
software, similar to a grid operating sys- 
tem, that simply doesn't yet exist." 

Quest's Harrison concurred. "Mis- 
sion-critical systems probably cannot 
take the risk of relying on a grid yet. Most 
computing grids are homogenous, while 
the true benefits will only be realized 
when a truly heterogeneous grid 
emerges," he said. 

"We think virtualization at the stor- 
age and I/O layers is practical now, as is 
virtualization of some elements of the 
presentation layers," he continued, 
talking of dynamic provisioning of Web 
servers, for instance. "However, in the 
middle tier, only limited opportunity 
for provisioning RDBMS and app 
servers exists today, and those opportu- 
nities only exist when they are all of the 
same type." 

What are the implications of putting 
Web services engines directly into 
the database (which major database 
vendors are doing)? How does this 
impact n-tier architectures? 
Not surprisingly, the major database 
vendors take a different view of this 
issue than their smaller competitors. 
Sleepycat's Wang described it as "simply 
their attempt to differentiate and avoid 
commoditization." 

The spokesmen from Quest and 
Microsoft take Wang's side. "We don't 
believe any large-scale take-up of Web 
services direct from the database will 
occur — at least not in a business-to- 
business or business- 
to-consumer context," 
said Harrison. "Secu- 
rity and authentica- 
tion issues are tough 
enough as it is." 

Microsoft's Wolter 
points to situations 
where handling Web 
services on the middle 





built Web services stacks used primarily 
as a way of exposing the database to 
internal applications written on plat- 
forms that can't easily get to the data- 
base directly." 

CA's Lipton said the embedding of 
Web services in the database intro- 
duces a greater use of 
database services not 
only for data access 
but also for applica- 
tion services. But, he 
said, "from a Web ser- 
vices and protocol 
perspective, this will 
not be as common as 
you would suppose." 
Why? Even though the protocols and 
XML tags are used in Web services 
information, semantic issues remain 
because applications often treat the 
same data differently. 

"From a database perspective, as 
more companies move to J2EE and 
.NET-developed applications, custom 
development by database type 
lessens," said Lipton. "No longer do 
developers code in database-specific 
SQL like T/SQL or PL/SQL; instead 
they are now invoking ANSI SQL data 
requests through JDBC connections, 
application servers or with XML. Data- 
base vendors are responding to this 
programming paradigm shift by not 



Quest's Harrison, "has been to lower over- 
all cost of database ownership because of 
commoditization of base RDBMS capa- 
bilities, rough parity between the big 
three database vendors, and emergence 
of open-source alternatives." 

Oracle, meanwhile, urges customers 



Some SO A models call for a data tier 
that is service-enabled. 'This frees 
the application tier from having to 
intimately know the data sources/ 



—Paul Lipton, senior architect for Computer Associates 



tier allows for better overall application 
scalability, leaving the database server to 
focus resources on the database itself. 
"Also," he added, "if the Web services 
being used are callable directly over the 
Internet, you generally want the data- 
base behind a couple of firewall layers, 
so you need to have the Web services 
layer operating in the DMZ. I see the in- 



only supporting Web services, but also 
embedding them within the database 
to improve performance." 

Will database vendors be changing 
their pricing models (which some feel 
pose a major barrier to innovation)? 

Pricing models are changing already. "The 
general trend for about five years," said 



'e are moving to a more on-demand, 
needs-focused data center. Computer 
power should be like electricity; the 
same is...true for your database needs. ' 



lack uriocker, marketing vice president for MySQL 



to look beyond list price. "Always look at 
total cost of ownership to determine 
their return on investment," advised 
Oracle's Hardie. 

How do you see the major vendors 
responding to solutions offered by 
new pure-play entrants? 

Here, database vendors are in consen- 
sus — up to a point. Software AG and 
Quest spokesmen both indicated that 
larger vendors generally do not feel 
competitive threats from smaller com- 
petitors, which lack the stability and 
credibility needed to attract large 
accounts. 

the database industry 
becomes more com- 
moditized, believes 
MySQL's Uriocker, 
"you will see the large 
vendors focus on other 
areas, such as the 
application stack or 
services. Even Oracle, 
which is No. 1 in the 
database market, has 
placed a key part of their bet on the 
future of applications like PeopleSoft." 
Oracle explained its focus as larger 
than just systems connectivity using 
Web services. "Oracle is delivering 
a complete SOA life-cycle manage- 
ment platform built on open stan- 
dards with support for XML, BPEL, 
SOAP, WSDL, UDDI, J2EE, JCA and 



But 



JMS," said Ashish Mohindroo, product 
director for Oracle database product 
marketing. 

What are the main barriers to suc- 
cessful execution? 

The vendors we contacted see plenty: 

• "Islands of management" resulting in 
lack of an integrated view of the infra- 
structure. 

• An information management philoso- 
phy that doesn't fully acknowledge the 
heterogeneity of information assets. 

• Inadequate business justification for 
the project. 

• Disparate or inconsistent representa- 
tions of data. 

• Poor design. 

• Inappropriate application choices. 

• Attempting to do too much at once. 

• Deployment problems, often because 
of lack of familiarity with new technology. 

And what can be done to overcome 
these barriers? Microsoft's Wolter coun- 
sels choosing your SOA 
projects very carefully. 
"There are classes of 
applications that will 
benefit greatly from 
SOA concepts and oth- 
er applications that 
don't fit the SOA mod- 
el well," he said. "The 
secret to success lies in 
closely analyzing the application to 
determine whether the potential bene- 
fits of using SOA justify the implemen- 
tation costs." 

Software AG's Taylor thinks SOAs 
should be implemented with tactical, 
business-driven projects. "Fortunately, 
a particular instance of SOA can be 
implemented incrementally and even 
in parallel to other SOA projects," he 
noted. 

Oracle's Hardie observed that an 
integration project requires more than 
technology to be successful. "The pro- 
ject needs to be clearly scoped and 
should have organizational buy-in from 
all departments that own the systems 
that are going to be integrated," he said. 
"From the technology perspective, 
companies need to base their integra- 
tion solution on open standards rather 
than proprietary technologies. In terms 
of SOA, they need to consider the com- 
plete life-cycle management of Web 
services and not just focus on connectiv- 
ity and orchestration." 

MySQL's Uriocker offered some 
implementation suggestions: "Get 
accustomed to new technology by using 
it for new projects first," he advised. "Go 
back and replace existing infrastructure 
only after you feel comfortable with 
newer technology and understand how 
to deploy it. Doing too much at once 
does sometimes work, but the upheaval 
costs are high." I 
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EDITORIAL 

The Application Security 
Tipping Point 

Two years ago, few enterprise development managers 
focused on application security. Two years from now, 
you won't find many for whom security isn't a top-of- 
mind issue. 

If you're thinking, "Security? That's handled by our 
firewall, encryption engines and enterprisewide identity 
management system," you're living in the past. Thanks to 
a confluence of events, security is going to span every 
aspect of the application development life cycle, from 
requirements and budgeting, to architecture and plat- 
form choices, to coding and testing, to deployment and 
management. 

What are those events? One is the increasing preva- 
lence of high-profile security failures. Earthquakes 
inspire re-evaluation and tightening of building codes. 
Business scandals lead to tighter accounting regulations. 
Today, applications developers are seeing the results of 
problems ranging from the Slammer worm that attacked 
SQL Server to the high-profile exposure of personal 
financial information from such prominent firms as Lexis- 
Nexis, ChoicePoint and HSBC Holdings (which offers 
GM MasterCards). Today, everyone is a potential target. 

Another driver is compliance. Thanks to U.S. govern- 
ment initiatives like HIPAA and Sarbanes-Oxley, many 
companies are now legally required to ensure the integrity 
of their data systems. Due to the steep penalties mandated 
by these regulations, corporations are redoubling efforts to 
ensure that their systems are buttoned up tight — and that 
means not only the network, but also the application code 
itself. Virtually no business is spared: Security pressure is 
trickling down through the food chain. 

Terrorism is the third driver. Think about Sept. 11 and 
the potential for economic, political and military disaster 
that a cyberterrorism attack would have on our society. 

A fourth driver is the flood of new tools focused on 
security validation of application code, as well as many 
books and conferences designed to teach developers 
about software security, such last month's Software Secu- 
rity Summit in San Diego, put on by BZ Media, the par- 
ent company of SD Times. 

Indeed, until recently, most architects, development 
managers, developers and test/QA teams didn't have sol- 
id guidance when it came to designing secure code, test- 
ing for security, and even understanding the vulnerabili- 
ties in their applications. Today, tools and resources are 
increasing in quality and quantity, and are both high-pro- 
file and generally affordable. 

Fifth, all players in the development life cycle are 
learning that they simply can't rely upon their platform 
makers to ensure applications security. Hackers are smart 
and numerous, and can find vulnerabilities everywhere. 
To paraphrase Smokey the Bear, "Only you can prevent 
security violations." The buck stops here. 

In this fast-changing environment, it is clear that build- 
ing quality applications means more than eliminating 
crashes, meeting functional specs and offering adequate 
performance. Application security has to be front-and- 
center of every software spec, every architecture, every 
set of coding best practices, every set of coding rules, and 
every test/QA cycle, every timeline, every budget. I 



The Case for Agile Database Development 



To paraphrase the egg mar- 
keting board, agile isn't just 
for application developers any- 
more — it's for all information 
technology professionals. This 
includes developers and devel- 
opment management, quality 
assurance professionals, and 
yes, even data professionals. 

I suggest that data profession- 
als must at least start adopting 
evolutionary (iterative and incre- 
mental) techniques and, better 
yet, agile techniques, if they are 
to remain relevant within the 
modern IT environment. This 
change will take several years 
and will prove to be difficult for 
some, but will result in greater 
overall levels of productivity. 

Let's examine two trends. 
First, every modern software 
development process — Extreme 
Programming (XP), Feature 
Driven Development (FDD), 
Scrum, Dynamic System Devel- 
opment Method (DSDM), Crys- 
tal, Agile Model Driven Devel- 
opment (AMDD), the Rational 
Unified Process (RUP) and the 
Enterprise Unified Process 
(EUP) — takes an evolutionary 
approach to development. Data 
professionals may not like this, 
and they may choose to fight 
against this trend, but the fact is 
that the IT sector is clearly mov- 
ing in this direction. 

The second trend has to do 
with agile software development. 
Agile techniques, such as XP, 
FDD, DSDM, Scrum and 
AMDD, are growing in popular- 
ity. The reason for this is sim- 
ple — they work very well in prac- 
tice. A simple definition of agile 
software development is that it is 
evolutionary development per- 
formed in a highly collaborative 
manner, delivering high-quality, 
working software that meets the 
highest priority needs of your 
project stakeholders. 

Many traditionalists like to 
denigrate agilists, yet the fact 
remains that true agile teams are 
building systems with incredibly 
high-quality code, concise docu- 
mentation, and a nearly 100 per- 
cent regression test suite (user 
interface testing can be tough), 
and are doing so very cost effec- 
tively. Can you honestly make 
this claim yourself? If not, I high- 
ly suggest taking agile seriously. 

AGILITY 101 

The agile manifesto (www 
.agilemanifesto.org) is defined 
by four simple value state- 



ments — the important thing to 
understand is that while you 
should value the concepts on 
the right-hand side, you should 
value the things on the left- 
hand side even more. A good 
way to think about the mani- 
festo is that it defines prefer- 
ences, not alternatives, encour- 
aging a focus on certain areas 
but not eliminating 
others. The values 
are as follows: 

• Individuals and 
interactions over pro- 
cesses and tools. 

• Working software 
over comprehensive 
documentation. 

• Customer collabo- 
ration over contract 
negotiation. 

• Responding to change over 
following a plan. 

Although these values are a 
good start, the Agile Alliance 
(www.agilealliance.org) also de- 
fines a collection of 12 princi- 
ples that guide agile software 
development. These principles 
focus on issues such as the need 
to deliver working software on 
a regular basis, to develop 
high-quality work, to embrace 
changing requirements, and to 
work closely with project stake- 
holders. Not exactly new con- 
cepts (many of them trace their 
roots to Fred Brooks' "The 
Mythical Man-Month"), but 
obviously very important ones. 

Many data professionals 
claim that agile techniques don't 
take data issues into account, 
something that is personally frus- 
trating considering my work in 
the Agile Data method (www 
.agiledata.org). We take data 
issues into account, but we rec- 
ognize that they aren't the center 
of the universe as some data pro- 
fessionals mistakenly believe. 

The Agile Data method is 
based on the idea that data pro- 
fessionals can add significant 
value to an application develop- 
ment project when they choose 
to work in an agile manner. 
Data professionals often have a 
very good understanding of 
enterprise issues, at least when 
it pertains to data, something 
that all development teams can 
benefit from. 

It's easy to say that data pro- 
fessionals need to work in an 
agile manner, but they also 
need techniques that allow 
them to do so. Luckily many 
techniques do exist, if data pro- 




fessionals choose to adopt 
them. And it is a choice. Data 
professionals do not need to 
limit themselves to near-serial 
development techniques. 

AGILE DATABASE TECHNIQUES 

Let's examine several of these 
techniques. The first is taking an 
agile approach to data modeling. 
The AMDD method 
( www. agilemodeling 
.com) describes prin- 
ciples and practices 
for effective model- 
ing and documenta- 
tion, techniques that 
can clearly be applied 
to data modeling 
activities. 

At the beginning 
of a project, your 
team should create a slim con- 
ceptual domain model, based 
on your enterprise domain 
model, if one exists, depicting 
the main business entities and 
the relationships between 
them. At this point in the pro- 
ject, you would not fill in 
details, such as data attributes 
or responsibilities — this is 
something you would do during 
development on a just-in-time 
(JIT) basis. Your goal is to iden- 
tify the landscape for now, 
trusting that you can fill in the 
details as they are needed. 

Agilists embrace change — 
they know that any investment 
made early in the project to cre- 
ate a detailed model risks being 
wasted due to changed require- 
ments. They also know that 
investing time in upfront 
detailed modeling pushes back 
the development of working 
software, increasing the risk to 
your project due to lack of con- 
crete feedback. During devel- 
opment, you use your concep- 
tual domain model to guide 
your physical object and data 
modeling efforts to ensure con- 
sistency between your schemas. 
An example agile data modeling 
case study is presented at 
www.agiledata.org/essays/agile 
DataModeling.html. 

The second technique is 
database refactoring. Just like 
developers have learned to 
refactor their object schemas, 
data professionals must learn to 
refactor their database schemas 
as well. In "Refactoring," Mar- 
tin Fowler described code 
refactoring as a disciplined way 
to make small changes to your 
code to improve its design, 
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making it easier to understand 
and to modify. 

Before adding a new feature 
to your code, you ask yourself if 
the current design is the best one 
possible to allow you to add that 
feature. If it is, then do so. If not, 
refactor your design to make it 
the best possible and then add 
the feature. The end result is 
that you keep your design the 
best possible, making it very easy 
to extend as needed. 

Similarly, a database refac- 
toring is a simple change to a 
database schema that improves 
its design while retaining both 
its behavioral and informational 
semantics. Your database 
schema includes both structural 
aspects, such as table and view 
definitions, and functional 
aspects, such as stored proce- 
dures and triggers. 

Database refactorings are 
clearly more difficult to imple- 
ment than code refactorings due 
to the increased coupling — a 
simple schema change could 
affect a score of applications 
that access that portion of 
the schema, so you need to be 
careful. Pramod Sadalage and 
I are in the process of publishing 
detailed descriptions of data- 
base refactorings at www 
.databaserefactoring.com, if you 
are interested in learning more. 

The third technique is test- 
driven development (TDD) 
where you write a unit test 
before you write business code. 
By following this technique, 
agilists build systems with near- 
ly 100 percent regression unit 
test suites — yes, the project 
teams must still perform other 
techniques, such as system and 
acceptance testing, as well. By 
having a regression test suite in 
place, you can safely refactor 
schemas because you know 
you'll be able to find, and then 
fix, any problems resulting from 
your refactorings. 

Fourth, agile developers 
work in their own, full environ- 
ments — environments that in- 
clude a database instance. 
Developers need to be able to 
safely test first before promot- 
ing a refactoring into their 
shared project integration envi- 
ronment, let alone your pre- 
production test environment. 

There are two main chal- 
lenges when it comes to adopt- 
ing agile database techniques — 
tooling and culture. The 
database tool vendors clearly 
have their work cut out for them. 
We need tools that are easy to 
learn to use and work with, and 
which enable us to make simple, 



incremental changes to our data- 
base schemas. These tools must 
be inexpensive enough so that 
they can be deployed on every 
development machine. 

We need databases with 
flexible licensing strategies that 
enable deployment to develop- 
er machines, database testing 
tools that enable us to quickly 
regression-test our work, evolu- 
tionary extract-transform-load 
tools, database refactoring 
tools, database modeling tools 
that are directly integrated into 
development tools, and more 
robust object-relational persis- 
tence frameworks. 

CHANGING TIMES 

Just a few years ago, people 
lamented that developers 
would never test their code 
properly, yet today agile devel- 
opers insist on writing their unit 
tests first. We realized that test- 
ing was so crucial to our success 
that we rethought our entire 
approach to testing, and we 
pretty much did so without the 
help of the testing community. 
Agilists also know that getting 
the data right is critical to our 
success as well. If the data com- 
munity doesn't step up and find 
ways to work together effectively 
with agilists, then we'll likely 
reinvent the way in which we 
approach data-oriented activi- 
ties, too. I believe that's already 
started, and I invite you to get 
involved while you still can. I 

Scott W. Ambler is the author of 
several books, including "Agile 
Database Techniques" (Wiley 
2003) and the newly released 
"The Enterprise Unified Process: 
Extending the Rational Unified 
Process" (Prentice Hall 2005). 
His home page is www 
. ambysoft. com/ scott Ambler html. 



Letters to the Editor 



WHY NETBEANS? 

David Rubinstein's column on 
Sun's tools non-strategy is right 
on target ["Sun's Golden Oppor- 
tunity," March 15, page 34]. 
Consider the message Sun is 
sending with NetBeans 4.1 — 
snatching defeat from the jaws 
of wider acceptance. 

This is the first version to 
support EJBs and Web services. 
What servers will be supported 
on release? Only Sun's server, 
thus sending a very negative 
message to those of us that 
don't want to get locked in to 
Sun. NetBeans should really 
be supporting at least JBoss, 
WebLogic and WebSphere. Not 
on some distant day, but on the 
first customer shipment. 

Too bad. A lot of good work 
is going into NetBeans. Eclipse 
needs the competition. 

Carl Schwarcz 

IT IS ENGINEERING 

Referring to Alan Holub's col- 
umn "Is Software Engineering 
an Oxymoron?" [March 15, 
page 28], I believe that "soft- 
ware engineering" is the best 
name for the process of build- 
ing software from scratch. It's a 
process of building software in 
a systematic approach. It's not 
just coding, as software devel- 
opment has become. It's way 
more than that. It's require- 
ments gathering; it's design 
and architecture specification; 
it's coding; it's testing; it's 
maintenance. 

Also, Mr. Holub, where did 
you find the statistic that mathe- 
maticians are poor coders? I 
would like to read about that 
somewhere. I believe that one 
has to be good in solving logical 



problems to be good in math. If 
you're good in math, you'll most 
likely make a good programmer. 

Here is what John Warnock, 
founder of Adobe, had to say in 
"Programmers at Work," by 
Susan Lammers, when asked if 
he could do his education over, 
would he concentrate on mathe- 
matics or computer science? 
"Oh, I've always liked mathemat- 
ics; problem solving has always 
been fun. My saving grace in life 
is that I was not introduced to 
computers at an early age." 

Here is what another great 
mind, Butler Lampson, had to 
say in the same book about 
math: "Physics and mathematics 
require that you think clearly to 
succeed in them. That's why 
many successful computer peo- 
ple come from these fields." 

I would like to compare that 
with your references. 

Stas Kubasek 

Software Engineer 

M.S. in computer science, 

minor in math 

CORRECTION 

IBM targets the Java rapid 
application development tool 
market with Rational Applica- 
tion Developer (formerly Web- 
Sphere Studio Application 
Developer) and Rational Web 
Developer (formerly Web- 
Sphere Studio Site Developer), 
which has functionality built into 
it from the company's acquisi- 
tion of RAD tool company Neu- 
Vis. Rational XDE is the compa- 
ny's modeling tool that plugs 
into Rational Application Devel- 
oper. The March 15 Industry 
Watch column inadvertently 
mischaracterized IBM's solu- 
tions in that market. 
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Do Your Developers Adhere To 
Industry Coding Standards? 

A large majority of developers do not adhere to standards that are being 
promoted by industry forums, according to Developer Relations Pro- 
grams 2005, a report published earlier this year by Evans Data. 

Garnered from responses of about 400 enterprise developers, 
the report showed that nearly 60 percent choose not to follow the 
norms, mainly for fear of losing their ability to differentiate through 
innovation. That, despite benefits often lauded by standards arbiters, 
which include interoperability with applications built by developers 
that did choose to follow the specs. 

Interestingly— but perhaps not surprisingly given the zeal of 
developers over their chosen language and coding style— some 
developers indicated that the reason for their nonconformance to 
standards was based on general principle. "They will code how they 
feel like coding," the report stated, "and they don't think a standards 
body could know what is best for the developers' applications." 



DATA WATCH 





Software Development Times 
May 1, 2005 - Issue No. 125 



Publisher 

Ted Bahr 

+1-631-421-4158 xlOl • ted@bzmedia.com 

Editor-in-Chief 

Alan Zeichick 

+1-650-359-4763 • alan@bzmedia.com 

Editor 

David Rubinstein 

+1-631-421-4158 xl05 • drubinstein@bzmedia.com 

Senior Editors 

Edward J. Correia 

+1-631-421-4158 xlOO • ecorreia@bzmedia.com 

Jennifer deJong 

jdejong@bzmedia. com 

Associate Editor 

Yvonne L. Lee 

+1-408-255-1153 • ylee@bzmedia.com 

Copy Chief 

Patricia Sarica 

psarica @bzn wdia . a >m 

Art Director 

Mara Leonardi 

mleonardi @bzn wdia , coi 1 1 



Columnists 

Andrew Binstock 

abinstock @pacificdataworks. com 

Allen Holub 

allen@holub.com 

Larry O'Brien 

lobrien @knowing. net 

Contributing Writers 

Shari L. Gould 

Geoff Koch 

Susan Messenheimer 

Lisa Morgan 

Esther Schindler 

George Walsh 
Carol Weiszmann 

Advertising Sales 
Southwest U.S. 

Julie Fountain 

+1-831-476-1 716 •jfountain@bzmedia.com 

Northwest U.S./Canada 

Paula F. Miller 

+1-925-831-3803 • pmiller@bzmedia.com 

Southeast U.S./Europe 

Jonathan Sawyer 

+1- 603- 924-4489 • jsawyer@bzmedia. com 

Northeast/North Central U.S./Canada 

Charlie Shively 

+1-508-893-0736 • cshively@bzmedia.com 

Advertising Traffic 

Phyllis Oakes 

+1-631-421-4158 x!15 • poakes@bzmedia.com 



Director of Events 

Donna Esposito 

+1-415-785-3419 • desposito@bzmedia.com 



Director of IT & Manufacturing 

Rebecca Pappas 

+1-631-421-4158 xl03 • rpappas@bzmedia.com 

Director of Circulation 

Agnes Vanek 

+1-631-421-4158 xlll • avanek@bzmedia.com 

Office Manager/Marketing 

Cathy Zimmermann 

+1-631-421-4158 xl08 •czimmermann@bzmedia.com 

Customer Service/Subscriptions 

+1-866-254-0110 • service@bzmedia.com 



Accounting 

Viena Isaray 

accounting@bzmedia. com 

Article Reprints 

Lisa Abelson • Lisa Abelson & Co. 

+1-516-379-7097 • fax +1-516-379-3603 

labelson@optoiiliiic.iui 

BZ Media f BRA 

President 

Ted Bahr 

Executive Vice President 

Alan Zeichick 

BZ Media LLC 

7 High Street, Suite 407 
Huntington, NY 11743 
+1-631-421-4158 • fax +1-631-421-4045 
www.bzmedia.com • info@bzmedia.com 



Presenting a FREE Web Seminar 

Technology Boost Alert: 
Taking Data Modeling to 
the Next Level! 




Wednesday, May 11 

1:00 p.m. Eastern 
10:00a.m. Pacific 




IT deportments are under pressure to better understand ihe busi- 
ness users while at the same lime reduce project time and cods. 
A model-driven approach to align business and IT is the answer. 

Don r 1 get slucJt using old IcchnologreE because you're using a 
irjoE from Ihe ZOLb century. P&Tf erDeilgnex is the muddinj; twri 
Tor the Use century. 

la this Web Kmlnarrui will leiini Iwty (m 

■ Create one cohesive and integrated wit of models tor your 

entire project — try THAT with other data modeling tools mud 

ill you'U gel is a data modell 
* Set up user-defined properties through extended model 

definitions, the easiest way lo conmiunicale your models. Try 



THAT using another dam modeling fcoolM 

* Use shortcuts and replication tedmology to share metadala 
across different models. Real metadata reuse is WAY more 
dun "culling and paslmg"! 

* Convert 90 pcrcenl of your Irwin models m Jour clicks or leu] I 

* Live demo of all of these and more' 

Alau during tbls Web wmlnar. you ndll learn aboaf the 
n>ll«wJng ciraf-iaiiag fuaelhiiK 

* Uodo-'Redo feature 

* Actual WYSIWYG printing 

- Dowrustream-'upslreara unpad analysis 

* Tangible subject urea definition 

* Integrated, robust, and flexible repository support 



David Dichmann, 

Senior Product Manager. PowcrUcKigiier 
Davh! Diehrftunti is senior product mm*$& ib* 
ctoipi tools ft. Sytwja. H* tnyiajw ihe technical 
mufcetinj, vision ftjidduwtiwiof Pftw£tDe0i(n*f F 
a l«ujin( walyM &i4 daJgfi ml for use in boj^i- 
uess infotowLcin sy&uems development D*vLd \m haw than l£ 
ytanj ^1 irtdusby axpeiittbte in both lac"htiLcal and business rote, 
woririiij with 3itull h stari-itp, *nd established bitwise*- I>»vid 
hw b«ti published Jn indu*tfy ma jaz^a and Li a ^jpulgf jpeafc- 
ef it industry e^ts. 




Matt CrrH&uii. 

Stniur System Cfuutillut, 
Pofri'rDrsigntr 

Matt Cieason has worked and consulted in applica- 
tion development and enterprise architecture for 
more than II years. His employers and clients 
include Fortune $00 companies- and federal, state, and local gov- 
ernments—for whom he lias provided modeling, SDLC, and 
application development services. Tbe author of many articles for 
Industry publications, Mart currently serves as senior sytfems con- 
sultant with Sybase, and is a PowerDesigner product specialist. 




Modtrttdr: DuvkJ Rubinsfcin 
Editor, SB Timci 

David Rubinstein brings mere than 25 years 
oF newspaper experience to his role as editor of 
SD Times. Over Ibe past Eve ycais r he bos cov- 
ered a wide range of software development 
issues — from ihe application development life cycle to emerg- 
ing standards and specifications and the business behind the 
software business. He also writes a regular column that -exam- 
ines the broader development industry as a whole. 




frndiiftdby 



Sponsarfd &y 




Register at: www.bzmedia.com/webseminar SYBASE 



www.sdtimes.com 



Software Development Times . May 1, 2005 . 



COLUMNS 



37 



The Terror of Code in the Wrong Hands 



The 20-to-l productivity rule says that 
5 percent of programmers are 20 
times more productive than the remain- 
ing 95 percent, but what about the 5 per- 
cent at the other end of the bell curve? 
Consider the software terrorist: the guy 
who stays up all night, unwittingly but 
systematically destroying the entire 
team's last month s work while "improv- 
ing" the code. He doesn't tell anybody 
what he's done, and he never tests. He's 
created a ticking time bomb that won't be 
discovered for six months. 

When the bomb goes off, you can't roll 
back six months of work by the whole 
team, and it takes three weeks of your 
best programmer's effort to undo the 
damage. Meanwhile, our terrorist gets a 
raise because he stays late so often, work- 
ing so hard. The brilliant guy who cleans 
up the debris gets a bad performance 
review because his schedule has slipped, 
so he quits. 

Valuable tools in the hands of experts 
become dangerous weapons in the 
hands of terrorists. The terrorist doesn't 
understand how to use generics, tem- 
plates and casts, and so with a single 
click on the "refactor" button he 
destroys the program's carefully crafted 
typing system. That single-click refactor 



is a real time saver for the expert. Script- 
ing languages, which in the right hands 
save time, become a means for creating 
write-only code that has to be scrapped 
after you've spent two months trying to 
figure out why it doesn't work. 

Terrorist scripts can be so central to 
the app, and so hard to understand, that 
they sometimes remain in the program, 
doubling the time required for 
all maintenance efforts. Terror- 
ist documentation is a font of 
misinformation. Terrorist tests 
systematically destroy the data- 
base every time they're run. 

Terrorist work isn't just non- 
productive, it's anti-productive. 
A terrorist reduces your team's 
productivity by at least an order 
of magnitude. It takes a lot 
longer to find a bug than to cre- 
ate one. None of the terrorist code ends 
up in the final program because it all has to 
be rewritten. You pay the terrorists, and 
you also pay 10 times more to the people 
who have to track down and fix their bugs. 

Given the difficulty that most organi- 
zations have in firing (or even identifying) 
incompetent people, the only way to 
solve this problem is not to hire terrorists 
at all; but the terrorists are masters of dis- 




guise, particularly in job interviews. They 
talk a good game, they have lots of expe- 
rience, and they have great references 
because they work so hard. 

Since the bottom 5 percent is indistin- 
guishable from the rest of the bottom 95 
percent, the only way to avoid hiring ter- 
rorists is to avoid hiring from the remain- 
ing 95 percent altogether. 

The compelling reason for 
this strategy is that the 20-to-l 
rule applies only when elite 
programmers work exclusively 
with other elite programmers. 
Single elite programmers who 
interact with 10 average pro- 
grammers waste most of their 
time explaining and helping 
rather than working. Two elite 
programmers raise the produc- 
tivity of a 20-programmer 
group by 10 percent. It's like getting two 
programmers for free. Two elite program- 
mers working only with each other do the 
work of at least 20 average programmers. 
It's like getting 18 programmers for free. If 
you pay them twice the going salary (and 
you should if you want to keep them), 
you're still saving vast amounts of money. 
Unfortunately, it's possible for a soft- 
ware terrorist to masquerade as an elite 



programmer, but this disguise is easier 
to detect. Programmers who insist on 
working in isolation (especially the ones 
who come to work at 4:00 p.m. and stay 
all night), the prima donnas who have 
fits when they don't get their way, the 
programmers who never explain what 
they're doing in a way that anyone else 
can understand and don't document 
their code, the ones that reject new 
technologies or methodologies out of 
hand rather than showing genuine 
curiosity — these are the terrorists. 

Avoid them no matter how many 
years of experience they have. 

Software terrorism is on the upswing. I 
used to quote the standard rule that the 
top 10 percent were 10 times more pro- 
ductive. The hiring practices prevalent 
since the dot-com explosion — which 
seem to reject the elite programmers by 
design — have lowered the general skill 
level of the profession, however. 

As the number of elite programmers 
gets smaller, their relative productivity 
gets higher. The only long-term solution 
to this problem is to change our hiring 
practices and our attitudes toward train- 
ing. The cynic in me has a hard time 
believing that either will happen, but we 
can always hope for the best. I 

Allen Holub is an architect, consultant 
and instructor in C/C++, Java and OO 
Design. Reach him at www.holuh.com. 



Sticker Shock From New Models 



Microsoft has finally announced the 
pricing for Visual Studio Team 
Server, Visual Studio 2005 and changes 
to the pricing for MSDN subscriptions, 
the SKU by which many professional 
developers have received their IDEs in 
the past. Visual Studio Team Server and 
a single seat of the most-capable IDE 
package (Visual Studio Team Suite) will 
retail for US$13,738 ($2,799 for Team 
Server plus $10,939 for VSTeam Suite 
and MSDN Premium). 

Microsoft asserts that this particular 
configuration is fairly nonsensical — a sin- 
gle developer doesn't need Team Server, 
and more significantly, few developers 
will buy Team Suite, which rolls three 
"enterprise role-based" IDEs of Archi- 
tect, Developer and Tester into one pack- 
age. Individual role-based Team Edition 
IDEs with MSDN Premium will retail for 
$5,469. Yearly renewals will be $2,299. 
You can get Team System only through 
subscription, so those prices are per year. 

Meanwhile, Visual Studio 2005 Pro- 
fessional Edition with an MSDN Premi- 
um subscription (the closest analog to 
the popular MSDN Universal subscrip- 
tion) is priced at $2,499, $300 less than 
the current MSDN Universal pricing, 
with renewals at $1,999. Or, Microsoft 
will provide a no-cost upgrade from Uni- 
versal to one of the Team System roles, 
but then you're on the Team System 
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resubscription list, which as mentioned 
previously costs $300 more per year. 

Prashant Sridharan, senior product 
manager for Developer Marketing, has 
said that the MSDN/U plus Premium 
option "is intended to be a superset of 
what you have today. And, it's lower 
priced than what you have 
MSDN/U." 

He also said, "We built the 
pricing model specifically to 
reward those customers who 
had MSDN Universal sub- 
scriptions," and "I honestly 
don't see how [the pricing and 
options] can be more fair to 
our customers." 

Given that the time 
between Visual Studio .NET 
2003 and Visual Studio 2005 
will span something awfully 
close to three renewal checks, and that 
Microsoft's description of MSDN/U is that 
the "subscription entitles you to receive 
continuous priority access to the latest 
Microsoft development tools," it's not sur- 
prising that many people feel the reward 
falls short of what could be hoped for. 

The core problem with this model is 
Microsoft's reification of roles into sepa- 
rate products. The suite is compelling; 
the roles are demeaning. The problem is 
made clear when you give Team Suite a 
role-based title similar to the Team Edi- 




tion titles: "Team Suite for Early 
Adopters, Power Consultants and Top 
Developers," or perhaps "Team Suite for 
People That Microsoft Needs to 
Embrace Team System Lest It Fail." 
They've integrated the tool suite and 
disintegrated their customer. 

Microsoft's greatest marketing strength 
is the advocacy of developers who use 
Redmond's products. If they 
don't adjust the Team System 
pricing and SKU packaging, 
the technology will never be 
seen by the only people that 
could make it "trickle up" in a 
large enterprise. Well. . .unless 
we accept that piracy is a real- 
ity in businesses big and small. 
There are a lot of businesses 
that have exactly one MSDN 
Universal subscription and yet 
manage to produce software. 

Fourteen thousand bucks is prohibi- 
tive for a single user, but I suspect the 
"nonsensical" package of a single Team 
Suite and a single Team Server may prove 
to be the biggest seller in the Team Sys- 
tem line. Even so, Microsoft would seem 
to be able to extract the same profit from 
single-purchase enterprises by selling 
Team Suite in three-user bundles priced 
the same as a single copy of Team Suite is 
priced today. Of course, they lose the 
profit of honest individual Team Suite 
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sales, but at $11K per developer, those are 
mostly theoretical sales. 

The killer technology in Team System 
is an SCM system that Microsoft hopes 
will be competitive with the likes of IBM 
Rational's ClearCase. The "likes" of 
ClearCase would have to include any 
number of products, ranging all the way 
to open-source products, and Team Sys- 
tem clearly isn't competing with free stuff 
(even though the myth that free stuff is 
inherently lower quality is, I should think, 
abandoned by even the staunchest true 
believer). 

ClearCase is a product that's been 
evolving since the 1980s in one of the few 
categories where a software failure is 
really, truly, highly likely to destroy busi- 
ness assets. Of course, ClearCase is 
owned by IBM, and it's not like that com- 
pany has corporate credibility, a global 
sales force, and a reputation for standing 
behind their products. Oh, wait. . . 

Bully for Redmond for going toe-to- 
toe with Big Blue, but let's face it, a ver- 
sion 1.0 SCM system from Microsoft is 
going to need all the help it can get. By 
splitting the Team Suite into four products 
(the three role-based Editions and the 
Server), none of which is singularly com- 
pelling, and by pricing their combination 
well above $10,000, Microsoft has made 
the uphill fight of their new Team System 
technologies much more difficult. I 

Larry O'Brien is a technology consul- 
tant, analyst and writer. Read his hlog at 
www. knowing., net. 
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Knuth Mixing It Up at Last 



On the campus of Stanford Uni- 
versity, there is unfolding probably 
the longest-awaited event in the history 
of computer science: Donald Knuth is 
back at work writing the final two vol- 
umes of "The Art of Computer Pro- 
gramming." The first three volumes are 
widely admired as the definitive analysis 
of algorithms and data structures. How- 
ever, this accolade insufficiently recog- 
nizes the importance of these volumes. 

Knuth, today an emeritus professor of 
computer science at Stanford, began this 
work in the early 1960s. At that time, most 
programs consisted of spaghetti code — a 
term little heard today but frequently 
intoned in that era — which referred to 
code hairballs (lots of global variables, fre- 
quent use of GOTO statements, etc.) that 
preceded structured programming. 

In those days, knowledge of data 
structures and algorithms was not wide- 
spread, nor was it easily located when 
needed. Consider that most computing 
was consigned to simple tasks: early 
forms of data processing (read data from 
cards, generate a report) or repetitive 
technical calculations. In this context, 
Knuth set out to analyze and explain the 
major algorithms and provide them in 
textbook format. 

The vision was for a five-volume set, 



of which only the first three tomes 
(Fundamental Algorithms, Seminumer- 
ical Algorithms — meaning mostly arith- 
metic — and Sorting and Searching) ever 
saw the light of day. All three are avail- 
able today from Addison-Wesley and 
are astonishingly good. 

The books were eminently readable; 
they became the de facto 
tomes for teaching computer 
science. Most great program- 
mers have copies on their 
shelves. [Editors note: So do 
former programmers who 
have since become technology 
journalists.] 

The remaining two vol- 
umes (Combinatorial Algo- 
rithms and Syntactical Algo- 
rithms) have lain frustratingly 
out of reach. First, Knuth took more 
than 10 years off to design TeX and then 
later the tools for literate programming. 
The former program, of course, is still 
the definitive tool for technical publica- 
tion (see "Has Text Processing 
Improved?" Feb. 15, page 32), while 
the latter has languished. Then, rather 
than writing the missing volumes, 
Knuth decided to revise the first three. 

But now, Knuth is releasing Volume 4 
in fascicles, which are installments of a 
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larger work that appear as stand-alone 
entities. The first, called Fascicle 2 
because No. 1 is still being written, is 
titled "Generating All Tuples and Per- 
mutations." The problem it treats is 
familiar to testers, who might need to 
create all possible test values in a given 
range. Knuth dives right in, treats the 
basic issues quickly, then 
explores Gray codes, trees of 
permutations, and the like. 

Knuth also has issued Fas- 
cicle 1 of Volume 1, which 
updates MM IX, the sequel to 
the assembly language called 
MIX, which he used in the 
original volumes. That lan- 

- '"-"T^H S ua S e na< ^ severe limitations, 
^ such as 6-bit bytes. Newer 

programmers might be sur- 
prised to know that bytes did not always 
tally 8 bits. The networking term "octet" 
is a distant echo of this history. 

The choice of assembly language is 
interesting. Knuth argues in the fascicle 
for assembly language in algorithms. 
Had he chosen a high-level language, he 
opines, he would have been jammed by 
history. He would have used Algol in the 
1960s; Pascal in the 1970s, C in the 
1980s, C + + in the 1990s, and Java in 
this decade. 




Also, he points out, high-level lan- 
guages are cumbersome when dis- 
cussing low-level operation — try dis- 
cussing bit twiddles in C, and you'll see 
how quickly you have to code around the 
language. This fascicle keys off Knuth's 
1999 book on MMIX (from Springer- 
Verlag), whose most interesting aspect is 
the design of the assembly language, and 
especially of the execution environment. 
His observations elucidate the architec- 
ture of today's virtual machines. 

One interesting aspect Knuth 
explores is the shortage of terms for 
referring to fields of 2, 4 and 8 bytes. 
What would you call the 2-byte field that 
holds a 16-bit Unicode character, for 
instance? Wide character doesn't cut it 
because that is the data that is placed in 
the nameless field. The term "word," of 
course, is no longer tenable. So, Knuth 
proposes wyde for 16 bits, tetrabyte (or 
tetra) for 32, and octabyte (or octa) for 
64. This small refinement makes it pos- 
sible to understand the new MIX 
machine with a clear grasp of the size of 
specific registers, data items and 
addresses. 

More fascicles are planned until Vol- 
ume 4 appears in 2006. Volume 5 will 
appear some years after that. To find out 
more, see Knuth's site at www-cs -faculty 
.stanford.edu/~knuth. I 

Andrew Binstock is the principal analyst 
at Pacific Data Works. 
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How do developers like to learn? 
Many read books that are relevant to 
their practice. Others rely on co-workers 
or developer Web sites to pick up tricks 
and shortcuts, and still others attend 
technical conferences to learn from the 
vendors of the software they use. 

There is, though, one thread that runs 
through all the choices: Developers like 
to learn from other develop- 
ers. Don't give them acade- 
mics. Don't give them so- 
called "experts" in a field. And 
for heaven's sake, don't give 
them marketers. Developers 
truly believe that unless you're 
a developer or you've been a 
developer, you don't know the 
trouble they've seen. 

Fran McKeagney learned 
this while at CBT Systems, a 
California-based company providing 
interactive education software. "We had a 
hard time reaching software guys," he 
said. "We just weren't getting usage with 
the software guys." 

When he founded InnerWorkings in 
2002 with the goal of providing educa- 
tional tools for developers, he learned 
his audience had been rejecting training 
materials written by technical writers. 
"It was clear to the developers that these 
people didn't make a living writing 
enterprise code." The learning industry 
just didn't adequately support the devel- 
opers, he said. 

Since that time, numerous educational 
and training Web sites have arisen, and 
books and downloadable tutorials remain 
plentiful. Attendance at technical confer- 
ences is finally rebounding to levels not 
seen since the dot-com implosion. Many 
of these are created by developers for 
developers. JavaOne, Tech-Ed and myri- 
ad other user conferences provide hands- 
on learning. DevX, IBM's alphaWorks and 
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MSDN all have large, thriving developer 
communities. But McKeagney says some- 
thing was lacking — the ability to work at 
your desk, in a tool you use, at your own 
pace, to improve your skills. 

Something else was missing, he 
believed — a way to get a developer from 
the competency he or she showed to get 
a job to becoming much more effective 
on the job. "Classroom teach- 
ing is conceptual," he said. 
"It's like reading a book on 
building a house and then 
going out and doing it." 
Developers, they learned, are 
being challenged like never 
before, being asked to "do 
more with less" even if their 
skill sets aren't quite up to par 
in certain areas. 

So McKeagney and his 
team developed software called the 
InnerWorkings Developer Interface, 
which includes something they call the 
Inferent code-judging engine. The soft- 
ware provides users with challenges that 
describe the objective and offer a prob- 
lem statement, and the developer builds 
the application and runs it. There are 
constraints as to what not to do as well as 
links to reference materials, hints and an 
e-mail link to a personal tutor. 

After the application is built, the user 
clicks on the "judge" button, and a score 
is returned. If errors were made, very 
specific feedback is returned. "It's a safe 
learning environment, but it's real- 
world," said Brian Finnerty, director of 
product marketing. 

InnerWorkings has collaborated with 
Microsoft to integrate its software into 
Visual Studio. The first practice set of 
challenges deals with developing for 
ASP.NET; currently, there are eight hours 
of coding challenges, involving such topics 
as Web controls and exception handling. 



By the end of the year, the company 
hopes to have hundreds of hours of prac- 
tice sets; Finnerty said the next sets in the 
works are for Web services and object-ori- 
ented design and development. 

For people worried about having a 
development process forced upon them, 
McKeagney said the reference materials 
and judging engine are based on Micro- 
soft Patterns and Practices Group infor- 
mation and the Microsoft curriculum. In 
the future, he added, the tool might be 
able to accommodate a company's best 
practices, so that the training of new 
employees becomes more standardized. 
Armed with US$8.8 million in Series A 
venture funding, that should happen 
sooner than later. 

Listen, I certainly understand people 
who hate being forced to change the way 
they do things. I started in this business 
writing my stories on a Royal manual 
typewriter. Then I was forced onto an 
IBM S electric, which had a unique set of 
characters that had to be typed into the 
text to instruct a scanning machine what 
to correct or omit. 

Since then, I've had to learn a num- 
ber of different applications, each with 
different nomenclatures and symbols for 
typesetting instructions. And I went 
kicking and screaming every time. If it 
were feasible, I'd go back to my manual 
typewriter in a heartbeat. 

Has learning these different systems 
made me a better writer? Microsoft Word 
certainly has made it easier to clean up my 
mistakes, but it doesn't help me with sto- 
ry organization, sentence construction, or 
those colorful turns of phrases we writers 
live for. But it hasn't hurt me either. So if 
learning some new best practices can 
make you a more efficient programmer, 
without hurting you from a creative per- 
spective, the benefits are clear — if not to 
you at first, then certainly to your compa- 
ny. Old dogs, like the one seated here, can 
always do with some new tricks. I 

David Rubinstein is editor of SD Times. 



t 



Z&& BHlZrl 



SCO GROUP REVENUES DECLINE 

Revenues for The SCO Group fell in the first quarter ended Jan. 31 r coming in 
at US$8.86 million, compared with $11.39 million for the same quarter a year 
earlier. In a statement, the company said the decline was attributable to "con- 
tinued competitive pressures on the company's Unix products and services." 
The company showed a net loss of $2.96 million, or 17 cents per share, com- 
pared with a net loss of $2.48 million, or 18 cents per share, for the first quar- 
ter a year ago. Darl McBride, SCO's president and CEO, said efficiency and cost- 
reduction measures helped the Unix business operate at a profit despite the 
drop in revenue. As to the company's ongoing Linux litigation, McBride said, 
"We remain steadfastly focused on winning in both the courtroom and in the 
marketplace." Bert Young, the company's chief financial officer, said, "We be- 
lieve we are in a position to continue operating our core business and see the 
litigation through to its conclusion." As for its notice from Nasdaq that it was 
subject to delisting for failing to file financial documents with the Securities and 
Exchange Commission on time, SCO said its subsequent filings make it eligible 
to remain listed on Nasdaq's SmallCap market. Until a conclusion is reached, 
SCO will continue to be listed as SCOXE. —David Rubinstein 



Computer Associates will buy back US$400 million in stock during fiscal 2006, 
the company's board announced. Since December 2004, when 19.2 million shares 
were available for repurchase under CA's program, the company has repurchased 
5.5 million shares. The company also announced it will double its annual cash div- 
idend to 16 cents per share, to be paid out in quarterly installments beginning with 
the dividend for the first fiscal quarter ending June 30. "These two actions indi- 
cate the confidence CA's board of directors and senior management has in the 
company's ability to grow and deliver shareholder value," said CA president and 
CEO John Swainson. 

EARNINGS: 

PalmSource reported revenue of US$17.2 million for its fiscal third quarter ended 
Feb. 25, a decline from the year-ago total of $21.6 million. The results include a 
month of results from China MobileSoft, which the company acquired in late Jan- 
uary. Net income on a non-GAAP basis was $600,000, or 4 cents per share, down 
from $3.6 million, or 32 cents per share, reported in the same quarter a year ear- 
lier. The company shipped 1.4 million units during the quarter, of which 77 percent 
were PDAs and other handhelds while 23 percent were smartphones. I 
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Banff, Alberta 
INTEGRATION CONSORTIUM 

www.globalintegrationsummit.com 



May 23-25 



PalmSource Mobile May 24-26 

Summit & DevCon 2005 

San Jose 
PALMSOURCE 

www.palmsource.com/events/devcon2005 



LinuxWorld Summit 

New York 

IDG WORLD EXPO 

www.linuxworldexpo.com 



May 25-26 



BREW 2005 Conference June 1-3 

San Diego 
QUALC0MM 

brew.qualcomm.com/brew/brew_2005 



Red Hat Summit 

New Orleans 
RED HAT 

www.redhat.com/promo/summit 



June 1-3 



Tech-Ed June 5-10 

Orlando, Fla. 

MICROSOFT 

www.microsoft.com/events/teched2005 

For a more complete calendar of U.S. software devel- 
opment events, see www.bzmedia.com/calendar. 
Information is subject to change. Send news about 
upcoming events to events@bzmedia.com. 
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Technology Boost Alert: 
Taking Data Modeling 
To the Next Level 

Time: 10 a.m. Pacific (1 p.m. Eastern) 
SYBASE AND SD TIMES 

www.bzmedia.com/webseminar 



May 11 
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Market leading defect and project-tracking with built-in customer support integi 
Manage the complete Issue llfecyde from support to development and back. 



Powerful 



Integrated 




to use 



phisticatod workflow hii^ 
Airtfl roirting and escalation 
Beta customer Wab portal 






Ttert Managarn 
C ustpmer Support 
VortionLinkforSCM 
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Paint-rnclick administration 
Windows and Wsb client 
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Improve Your Process, Start Testing Now 

Once you start using our tools, you are well on your way to building 
rock solid applications, in the shortest possible time, guaranteed! 

Get your free trial at www,automatedqaxom\downloads 



Award Winning Testing Solutions 



TestComplete 

"AutomatedQA's TeeJCompfete is a great product and just as capable as the Tercet 
leader el less than tirtt-l&lth she price Wily would gftyiMdy pay G&QOO per sea^ far 
!eslflutcmalwn? u 

Jge/$jtwfety 



• GUI Testing 

• Unit Testing 

• Regression Tesfag 

• Funckiryl Testing 

• Lead TesliiB 

• Distributed Testing 

• Wat Testing 

• Date-Driven Testing 

• Object-Driven Testing 
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Performance aitif Memory 
Profiling 



AQtime 

• MartagfitS/UnmanagBdAppllcaJions 

• Performance Analysis 

• Test Coverage 

» Msrnory Analysis 

■ Llrta^evei Precision 

■ Microsoft Visual Studio NET 
Integration 






Issue Tracking ami Project 
Managmsnt 



AQdevTeam 



Configurable Workflows 
Configurable Fields 
Configurable Forms 
Scriptabe Ma^ns 
Email Nellcalrons 
Web Interface 
Windows [menace 
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Build Automation and Release 
Managnait 



Automated 
Build Studio 

* V?BuaU/acno Builder 

* EKtsnalbJeAcllomG 

* SchKJu*BdBu3d& 

* T&sl fcniearalfon 

* !s$uq Trwfcjng Ifltagirrtioii 

» Microsoft Visual Sludto .NET 
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HutomatedQfl 

www, automaijedqa com 



(702)891-9424 

All AutanatwSQA products Induda a 60 day money-hack guarantee 



